From a58197f6a4698591cbe36c937fae5429bf0323c6 Mon Sep 17 00:00:00 2001 From: Casper Welzel Andersen Date: Tue, 21 Apr 2026 14:40:21 +0200 Subject: [PATCH 1/3] Replace push-protected with direct push via TEAM4-0 bypass The push-protected action relies on CI running on the push-action/** temp branch to satisfy required status checks before pushing to master. GitHub no longer triggers workflows for pushes made from within a running workflow, so the temp branch CI never runs, push-protected declares all checks vacuously complete, and the push fails. Instead, a repository ruleset now enforces required status checks on master with TEAM4-0 as an explicit bypass actor. The CD workflow pushes directly as TEAM4-0 using the RELEASE_PAT, bypassing the status check requirement for this automated bot commit. --- .github/workflows/cd_release.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/workflows/cd_release.yml b/.github/workflows/cd_release.yml index cdc023c5..a94399c4 100644 --- a/.github/workflows/cd_release.yml +++ b/.github/workflows/cd_release.yml @@ -74,13 +74,9 @@ jobs: - name: Update '${{ env.DEFAULT_REPO_BRANCH }}' if: steps.update_version_step.outputs.continue_workflow == 'true' - uses: CasperWA/push-protected@v2 - with: - token: ${{ secrets.RELEASE_PAT }} - branch: ${{ env.DEFAULT_REPO_BRANCH }} - pre_sleep: 15 - force: false - unprotect_reviews: true + run: | + git remote set-url origin "https://TEAM4-0:${{ secrets.RELEASE_PAT }}@github.com/${{ github.repository }}.git" + git push origin ${{ env.DEFAULT_REPO_BRANCH }} publish_container_image: name: Publish Container image on GH Packages From ff63436f9725660e4a535134e2415d6e55f1f83a Mon Sep 17 00:00:00 2001 From: Casper Welzel Andersen Date: Tue, 21 Apr 2026 14:50:32 +0200 Subject: [PATCH 2/3] Use RELEASE_PAT for checkout to ensure push authenticates as TEAM4-0 Copilot review: actions/checkout persists GITHUB_TOKEN credentials that would override a remote URL change. Passing token: RELEASE_PAT to the checkout step ensures the persisted credential is already the RELEASE_PAT, so the git push uses it without needing to modify the remote URL. --- .github/workflows/cd_release.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cd_release.yml b/.github/workflows/cd_release.yml index a94399c4..8b8e281d 100644 --- a/.github/workflows/cd_release.yml +++ b/.github/workflows/cd_release.yml @@ -27,6 +27,7 @@ jobs: uses: actions/checkout@v6 with: fetch-depth: 0 + token: ${{ secrets.RELEASE_PAT }} - name: Set up git config run: | @@ -74,9 +75,7 @@ jobs: - name: Update '${{ env.DEFAULT_REPO_BRANCH }}' if: steps.update_version_step.outputs.continue_workflow == 'true' - run: | - git remote set-url origin "https://TEAM4-0:${{ secrets.RELEASE_PAT }}@github.com/${{ github.repository }}.git" - git push origin ${{ env.DEFAULT_REPO_BRANCH }} + run: git push origin ${{ env.DEFAULT_REPO_BRANCH }} publish_container_image: name: Publish Container image on GH Packages From 68904ae0b462f4509565378cf0d6b2c65eaff1b4 Mon Sep 17 00:00:00 2001 From: Casper Welzel Andersen Date: Tue, 21 Apr 2026 15:01:30 +0200 Subject: [PATCH 3/3] Remove dead push-action/** trigger from ci_tests.yml push-protected is no longer used so these temp branches are never created. The trigger and its explanatory comment are dead code. --- .github/workflows/ci_tests.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml index a1e9f153..36408b9d 100644 --- a/.github/workflows/ci_tests.yml +++ b/.github/workflows/ci_tests.yml @@ -5,7 +5,6 @@ on: push: branches: - 'master' - - 'push-action/**' # Allow pushing to protected branches (using CasperWA/push-protected) jobs: pre-commit_audit: