Skip to content

v7.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 13:59
· 7 commits to main since this release
v7.0.0
68a2a7f
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

馃専 [Major]: Reusable workflows now use GitHub App orchestration and explicit publish credentials (#408)

Process-PSModule now performs repository inspection, versioning, release management, and pull-request feedback through a configured GitHub App. Publishing uses the explicit PSGALLERY_API_KEY credential consistently from the reusable workflow through the publishing action.

Breaking Changes

Caller workflows must now pass GitHub App credentials and the PowerShell Gallery credential through the reusable workflow contract. Workflows that omit these required secrets fail before their dependent stages run.

secrets:
  PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
  GitHubAppClientId: ${{ secrets.GITHUB_APP_CLIENT_ID }}
  GitHubAppPrivateKey: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}

The caller can retain any local GitHub App secret names; only the reusable-workflow boundary names are fixed. PSGALLERY_API_KEY is also the input name of the publishing action.

Changed: Scoped GitHub automation

Every GitHub-dependent stage now mints a short-lived token for the triggering repository and requests only the access it needs. Version planning reads repository and pull-request data, builds read repository metadata, and publishing creates releases, uploads assets, cleans prereleases, and posts pull-request comments through the configured App.

The GitHub App installation needs Contents: write and Pull requests: write. Metadata: read is granted automatically. Permissions such as Actions, Statuses, Pages, and ID tokens remain part of the caller workflow's default github.token path and are not App permissions.

Technical Details

  • Plan, Build-Module, and Publish-Module mint repository-scoped installation tokens with pinned actions/create-github-app-token.
  • GitHub-facing actions receive the token only through step-scoped GH_TOKEN; the GitHub App path has no github.token fallback.
  • The release path, version resolution, repository metadata reads, settings, comments, and prerelease cleanup all use the App token.
  • The reusable workflow, publishing action input, action environment variable, and Process-PSModule documentation use PSGALLERY_API_KEY.
  • Canonical caller templates and Process-PSModule documentation include the App credential contract, PowerShell Gallery credential, permission matrix, and Dependabot configuration requirement.
  • The GitHub-Script named-token-input hardening follow-up remains tracked separately.
Related issues
Assets 2
Loading