From 71543417b4854c861c0dc0cf4733e8ccf53ed3b6 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Fri, 24 Jul 2026 16:43:53 +0530 Subject: [PATCH] SK-2986 use PAT for release version-bump push to bypass branch protection Branch-protection rulesets now enforce PR + approval + a build status check on main (staged). The automated version-bump commit is pushed directly to main as github-actions[bot], which is not a ruleset bypass actor, so the push would be rejected. Point the release checkout at PAT_ACTIONS (a repo-admin credential) so its token is persisted and reused for the push, satisfying the ruleset's repo-admin bypass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/shared-build-and-deploy.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/shared-build-and-deploy.yml b/.github/workflows/shared-build-and-deploy.yml index 135b87bc..58a01fd9 100644 --- a/.github/workflows/shared-build-and-deploy.yml +++ b/.github/workflows/shared-build-and-deploy.yml @@ -20,6 +20,11 @@ jobs: - uses: actions/checkout@v2 with: fetch-depth: 0 + # Persist an admin credential so the automated version-bump push + # below satisfies the branch-protection ruleset's repo-admin bypass; + # the default GITHUB_TOKEN (github-actions[bot]) is not a bypass + # actor and would be rejected once PR enforcement is active. SK-2986. + token: ${{ secrets.PAT_ACTIONS }} - uses: actions/setup-python@v2 - name: Install dependencies