ci: add release workflow, CODEOWNERS, and explicit job permissions#1258
Merged
Conversation
- New release.yml: workflow_dispatch trigger that runs `nx release version`, commits + tags, and pushes to master with --follow-tags. The tag push leaves manual GitHub Release creation as the publish gate. - Add CODEOWNERS for /.github/ and /nx.json so release/security configuration changes require maintainer review (requires the matching "Require review from Code Owners" toggle in the master ruleset). - Set explicit permissions blocks on codeql-analysis.yml (security-events: write) and deploy-docs.yml (contents: write) so they keep working once the repo default workflow permission is read-only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the GITHUB_TOKEN / RELEASE_TOKEN fallback in release.yml with a short-lived token minted by actions/create-github-app-token from the dockview-release-bot App. The job now declares `environment: release`, so the App credentials (RELEASE_APP_ID, RELEASE_APP_PRIVATE_KEY) are only injected for runs targeting that environment — gated by its master-only deployment branch policy. Job-level permissions drop to `contents: read` since pushes flow through the App token, not GITHUB_TOKEN. Action pinned to commit SHA (v3.1.1, 2026-04-11) to avoid tag-repointing supply-chain risk. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maintainer prefers version-tag pinning across the project's workflows. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Configure git user.name/email from the App's bot identity (resolved via the GitHub API using the app-slug) instead of the generic github-actions[bot]. This matches the push identity (the App token) so the commit author and pusher line up and commits are GitHub-verified. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Pass workflow_dispatch specifier via env var instead of interpolating into the shell command — eliminates a shell-injection vector even though dispatch is restricted to users with write access. - Move app-slug interpolation into env: in the "Get App user id" step to match the pattern used by "Configure git". Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release.yml(workflow_dispatch) runsnx release versionnon-interactively, commits + tags, and pushes to master with--follow-tags. Auth is via a GitHub App token (actions/create-github-app-token), scoped to areleaseenvironment. Manual GitHub Release creation remains the publish gate (existingpublish.ymlis unchanged)..github/CODEOWNERSfor/.github/and/nx.jsonso changes to release plumbing and workflow security require maintainer review.permissions:blocks tocodeql-analysis.yml(security-events: write) anddeploy-docs.yml(contents: write) so they keep working once the repo default workflow permission is set to read-only.Required follow-up (manual, in repo Settings)
release.ymlto push to a protected master, add the GitHub App to the ruleset bypass list. TheRELEASE_APP_ID/RELEASE_APP_PRIVATE_KEYsecrets must be set on thereleaseenvironment.Test plan
release.ymlwithdry-run: truefrom the Actions UI and confirm it computes the next version, makes the local commit, and skips the push step.JamesIves/github-pages-deploy-actionstep indeploy-docs.ymlstill completes after the read-only default is enabled (thecontents: writeblock should make it work).🤖 Generated with Claude Code