ci: changesets release uses github app token#770
Merged
Conversation
Route changesets/action through the GitHub App token so the "Version Packages" PR is authored by the App and therefore triggers CI (test, check-dist, zizmor). The default GITHUB_TOKEN cannot trigger downstream workflow runs regardless of its permission scopes. Job permissions are left intact; the App token is scoped to contents and pull-requests writes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This was referenced May 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Route
changesets/actionthrough the GitHub App token (the same App added in #769) by setting itsGITHUB_TOKENenv to${{ steps.app-token.outputs.token }}.Why
The changesets "Version Packages" PR was created with the default
GITHUB_TOKEN, so — like the other automation PRs fixed in #769 — it opened with no CI (test,check-dist,zizmor):This is about token identity, not permission level — a
GITHUB_TOKEN-authored PR can't trigger workflows regardless of scopes. Authoring it via the App fixes that, so the release PR (which carries the version bump andCHANGELOG.mdupdates) now runs the actions.Notes
contents: write(push the version/CHANGELOG commit, tags, GitHub releases) andpull-requests: write(create/update the Version Packages PR).id-token: writefor npm provenance (OIDC trusted publishing).v*tags pushed at publish time will now triggersync-readme-versions, whose PR is also App-authored (ci: pr automation use github app token #769) and so will run CI too.APP_CLIENT_ID(variable) andAPP_PRIVATE_KEY(secret).🤖 Generated with Claude Code