v10.2.0-alpha.2

Fixes

fix(ci): push release tag with GitHub App token so publish.yml triggers (#9097)

fix(ci): push release tag with GitHub App token so publish.yml triggers (#9097)

Summary

publish.yml (the NPM trusted-publishing workflow) is triggered by a push: tags: v* event, among other triggers. build-version-release.yml creates that tag via pnpm lerna version, but the tag was never actually triggering publish.yml.

Root cause: lerna version pushes the version commit/tag to the origin remote, and origin's credentials were still the default GITHUB_TOKEN persisted by actions/checkout (the Setup Git step's gh-token remote was unused — lerna pushes to origin, not gh-token — and was seeded before the GitHub App token even existed). GitHub explicitly does not trigger downstream workflow runs for pushes authenticated with the default GITHUB_TOKEN, to avoid recursive triggering. So the tag got created, but publish.yml never fired.

Changes

• actions/checkout: set persist-credentials: false so the default token isn't left wired into origin.
• Setup Git: drop the unused/misconfigured gh-token remote (it referenced the default token anyway, and nothing pushed to it).
• Push Version: before running lerna version, point origin at the already-generated GitHub App installation token (x-access-token:${GITHUB_TOKEN}) so the resulting tag push is authenticated as the GitHub App and correctly triggers publish.yml's push: tags: v* trigger.

Test plan

• YAML validated (python3 -c "import yaml; yaml.safe_load(open(...))" passes).
• Run build-version-release.yml via workflow_dispatch with dry_run: false (or the next real release) and confirm publish.yml fires automatically off the resulting tag push, without needing a manual workflow_dispatch.

---

Generated by Claude Code

---