From 74230b01b49d1c9241ac2f147bf4e1aea8e858bf Mon Sep 17 00:00:00 2001 From: Alessandro Yuichi Okimoto Date: Thu, 16 Jul 2026 22:22:21 +0900 Subject: [PATCH] ci: replace classic pat with github app token Replaces the classic PAT (WORKFLOW_TOKEN) with a short-lived installation token minted from a GitHub App for release-please, and uses the built-in GITHUB_TOKEN (packages: write) for the ghcr.io login, as part of removing classic PATs from CI. Co-authored-by: Cursor --- .github/workflows/release-binaries.yaml | 7 +++++-- .github/workflows/release.yml | 9 ++++++++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml index 60dc208b7..56e78f80b 100644 --- a/.github/workflows/release-binaries.yaml +++ b/.github/workflows/release-binaries.yaml @@ -9,6 +9,9 @@ on: jobs: release: runs-on: ubuntu-latest + permissions: + contents: write # goreleaser uploads release assets + packages: write # push images to ghcr.io steps: - uses: actions/checkout@v4 @@ -22,8 +25,8 @@ jobs: uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0 with: registry: ghcr.io - username: ${{ secrets.GHCR_USER_NAME }} - password: ${{ secrets.WORKFLOW_TOKEN }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - name: Run GoReleaser uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c6dbafdbd..13f4a8e66 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,13 @@ jobs: name: Release Please runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ secrets.RELEASE_BOT_APP_ID }} + private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - uses: googleapis/release-please-action@5792afc6b46e9bb55deda9eda973a18c226bc3fc # v4.1.5 with: - token: ${{ secrets.WORKFLOW_TOKEN }} # We need to set the PAT so the publish workflow can be triggered + token: ${{ steps.app-token.outputs.token }} # App token so the tag/release created by release-please can trigger other workflows