Skip to content

fix: use release app for npm version finalization #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jan-kubica merged 1 commit into from
Jun 4, 2026
Merged

fix: use release app for npm version finalization #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 36 additions & 10 deletions .github/workflows/npm-version-finalize.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@ on:
description: "true when this run created or updated release state."
value: ${{ jobs.finalize.outputs.changed }}
secrets:
RELEASE_APP_ID:
description: Optional GitHub App ID for release tag and GitHub release writes.
required: false
RELEASE_APP_PRIVATE_KEY:
description: Optional GitHub App private key for release tag and GitHub release writes.
required: false
CHANGELOG_APP_ID:
description: Optional GitHub App ID for changelog PRs.
required: false
Expand All @@ -57,15 +63,32 @@ jobs:
name: Release state
runs-on: ubuntu-latest
timeout-minutes: 15
env:
HAS_RELEASE_APP_CREDENTIALS: >-
${{ (secrets.RELEASE_APP_ID != ''
&& secrets.RELEASE_APP_PRIVATE_KEY != '')
|| (secrets.CHANGELOG_APP_ID != ''
&& secrets.CHANGELOG_APP_PRIVATE_KEY != '') }}
outputs:
version: ${{ steps.validate.outputs.version }}
tag: ${{ steps.validate.outputs.tag }}
dist-tag: ${{ steps.validate.outputs.dist_tag }}
changed: ${{ steps.validate.outputs.changed }}
steps:
- name: Mint release token
id: release-token
if: env.HAS_RELEASE_APP_CREDENTIALS == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.RELEASE_APP_ID || secrets.CHANGELOG_APP_ID }}
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY || secrets.CHANGELOG_APP_PRIVATE_KEY }}
Comment on lines +83 to +84
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Fall back to github.token when release app is absent

When a caller provides only the existing CHANGELOG_APP_* secrets, this mints a changelog-app token and the later checkout, tag creation, and release edits all use steps.release-token.outputs.token instead of github.token. That breaks the stated compatibility path for repos without RELEASE_APP_*, and it can make finalization fail for protected v* tags when the changelog app is scoped only for changelog PRs rather than release/tag writes. Prefer minting this token only from a complete RELEASE_APP_* pair and let missing release credentials keep the github.token fallback.

Useful? React with 👍 / 👎.

owner: ${{ github.repository_owner }}
repositories: ${{ github.event.repository.name }}

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
token: ${{ steps.release-token.outputs.token || github.token }}

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
Expand All @@ -86,7 +109,7 @@ jobs:
id: validate
shell: bash
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ steps.release-token.outputs.token || github.token }}
VERSION_FILE: ${{ inputs.version-file }}
PACKAGE_FILES: ${{ inputs.package-files }}
PUBLISH_TO_NPM: ${{ inputs.publish-to-npm }}
Expand Down Expand Up @@ -329,21 +352,24 @@ jobs:
- name: Create tag
if: steps.validate.outputs.changed == 'true'
env:
GH_TOKEN: ${{ steps.release-token.outputs.token || github.token }}
REPOSITORY: ${{ github.repository }}
RELEASE_TAG: ${{ steps.validate.outputs.tag }}
TARGET_SHA: ${{ github.sha }}
run: |
set -euo pipefail
if git show-ref --verify --quiet "refs/tags/${RELEASE_TAG}"; then
if gh api "repos/${REPOSITORY}/git/ref/tags/${RELEASE_TAG}" >/dev/null 2>&1; then
exit 0
fi
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "$RELEASE_TAG" -m "$RELEASE_TAG"
git push origin "$RELEASE_TAG"
gh api "repos/${REPOSITORY}/git/refs" \
--method POST \
--field ref="refs/tags/${RELEASE_TAG}" \
--field sha="${TARGET_SHA}" >/dev/null

- name: Stage GitHub release
if: steps.validate.outputs.changed == 'true'
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ steps.release-token.outputs.token || github.token }}
RELEASE_TAG: ${{ steps.validate.outputs.tag }}
run: |
set -euo pipefail
Expand Down Expand Up @@ -421,7 +447,7 @@ jobs:
- name: Publish GitHub release
if: steps.validate.outputs.changed == 'true'
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ steps.release-token.outputs.token || github.token }}
RELEASE_TAG: ${{ steps.validate.outputs.tag }}
run: gh release edit "$RELEASE_TAG" --draft=false

Expand All @@ -439,5 +465,5 @@ jobs:
contents: write
pull-requests: write
secrets:
app_id: ${{ secrets.CHANGELOG_APP_ID }}
app_private_key: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
app_id: ${{ secrets.CHANGELOG_APP_ID || secrets.RELEASE_APP_ID }}
app_private_key: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY || secrets.RELEASE_APP_PRIVATE_KEY }}
Loading