88jobs :
99 release-plz-release :
1010 name : Release-plz release
11+ environment : release # Optional: for enhanced security
1112 runs-on : ubuntu-latest
1213 if : ${{ github.repository_owner == 'agentclientprotocol' }}
1314 permissions :
@@ -16,20 +17,32 @@ jobs:
1617 steps :
1718 - &checkout
1819 name : Checkout repository
19- uses : actions/checkout@v5
20+ uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2021 with :
2122 fetch-depth : 0
22- persist-credentials : true
23- token : ${{ secrets.RELEASE_PLZ_TOKEN }}
23+ persist-credentials : false
2424 - &install-rust
2525 name : Install Rust toolchain
26- uses : dtolnay/rust-toolchain@stable
26+ uses : dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
27+ with :
28+ toolchain : stable
29+ - &generate-token
30+ # Generating a GitHub token, so that PRs and tags created by
31+ # the release-plz-action can trigger actions workflows.
32+ name : Generate GitHub token
33+ uses : actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
34+ id : generate-token
35+ with :
36+ # GitHub App ID secret name
37+ app-id : ${{ secrets.RELEASE_PLZ_APP_ID }}
38+ # GitHub App private key secret name
39+ private-key : ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
2740 - name : Run release-plz
28- uses : release-plz/action@v0.5
41+ uses : release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11
2942 with :
3043 command : release
3144 env :
32- GITHUB_TOKEN : ${{ secrets.RELEASE_PLZ_TOKEN }}
45+ GITHUB_TOKEN : ${{ steps.generate-token.outputs.token }}
3346
3447 release-plz-pr :
3548 name : Release-plz PR
4457 steps :
4558 - *checkout
4659 - *install-rust
60+ - *generate-token
4761 - name : Run release-plz
48- uses : release-plz/action@v0.5
62+ uses : release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11
4963 with :
5064 command : release-pr
5165 env :
52- GITHUB_TOKEN : ${{ secrets.RELEASE_PLZ_TOKEN }}
66+ GITHUB_TOKEN : ${{ steps.generate-token.outputs.token }}
0 commit comments