Repository navigation
chore(release): authenticate Release Please with a GitHub App - #224
Conversation
Use a short-lived installation token so release PR updates trigger CI. Scope the token to this repository and request contents, issues, and pull requests write access only in the release job. Preserve npm trusted publishing, provenance, package checks, and recovery behavior.
francoischalifour
changed the title
albert20260301
left a comment
albert20260301
left a comment
There was a problem hiding this comment.
This moves Release Please writes to a repository-scoped App token while preserving npm trusted publishing and its separate OIDC permissions. The omitted owner defaults to the current repository owner in the pinned action. No blocking findings.
Verify the first post-merge push creates the release PR with CI using the configured App installation; live authentication has not been exercised by this review.
|
The first post-merge main-push run successfully created the App token, ran Release Please, and revoked the token. Live authentication is verified. Release Please found no user-facing commits and correctly created no release PR. Downstream PR-check triggering remains to be verified on the next release-producing change; npm publication was skipped. |
Authenticate Release Please with a short-lived GitHub App installation token, following
altertable-ai/data-app. Restrict the token to this repository with contents, issues, and pull requests write access, and reduce the release job'sGITHUB_TOKENto read access.