From 1a11d8d636a30f42f97d03aa7573de7a2253dcb6 Mon Sep 17 00:00:00 2001 From: atharva-bhange Date: Tue, 28 Jul 2026 11:43:31 +0530 Subject: [PATCH] ci(changelog): open the release-notes PR with the App token, not GITHUB_TOKEN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The org forbids GitHub Actions from creating PRs with GITHUB_TOKEN; App installation tokens are exempt (release bot App already installed on this repo). Mint a scoped token and use it for both the branch push and gh pr create — consistent with how future-agi opens its release PRs, and avoids relaxing the org-wide setting. Co-Authored-By: Claude Fable 5 --- .github/workflows/changelog-sync.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/changelog-sync.yml b/.github/workflows/changelog-sync.yml index 5f3217f0..d64d0dd4 100644 --- a/.github/workflows/changelog-sync.yml +++ b/.github/workflows/changelog-sync.yml @@ -14,7 +14,16 @@ jobs: open-changelog-pr: runs-on: ubuntu-latest steps: + # App token (not GITHUB_TOKEN): the org forbids Actions from creating PRs + # with GITHUB_TOKEN, and App-minted tokens are exempt. Scoped to this repo. + - uses: actions/create-github-app-token@v2 + id: app-token + with: + app-id: ${{ secrets.RELEASE_BOT_APP_ID }} + private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} - uses: actions/checkout@v4 + with: + token: ${{ steps.app-token.outputs.token }} - uses: actions/setup-node@v4 with: node-version: 20 @@ -28,7 +37,7 @@ jobs: node scripts/changelog-from-release.mjs "$VERSION" /tmp/release-body.md src/pages/docs/release-notes.mdx - name: Open PR env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} VERSION: ${{ github.event.client_payload.version }} RELEASE_URL: ${{ github.event.client_payload.release_url }} run: |