fix(scripts): use App ID (not installation ID) for tag ruleset bypass actor

The GitHub Rulesets API expects the App's numeric ID as �ctor_id for
Integration bypass actors, not the installation ID. The installation ID
endpoint also requires App JWT auth rather than a user token.

Removes the installation ID lookup step entirely — APP_ID (available as
a script parameter) is passed directly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: kieronlanning

scripts/setup-release.ps1

@@ -236,59 +236,51 @@ if (Test-RulesetExists $TagRulesetName) {
 } else {
     Write-Info "Configuring tag ruleset for v* ..."
 
-    if ($TokenType -eq 'app' -and $AppId -and $AppPem) {
-        Write-Info "GitHub App detected — fetching installation ID ..."
+    if ($TokenType -eq 'app' -and $AppId) {
+        # Use App ID directly as the Integration bypass actor.
+        # The actor_id for an Integration (GitHub App) bypass is the App's numeric ID,
+        # NOT the installation ID. The App must be installed on the repo/org first.
+        Write-Info "GitHub App detected — creating tag ruleset with App ID $AppId as bypass actor ..."
+
+        $TagRulesetBody = @{
+            name        = $TagRulesetName
+            target      = 'tag'
+            enforcement = 'active'
+            conditions  = @{
+                ref_name = @{ include = @('refs/tags/v*'); exclude = @() }
+            }
+            rules        = @(
+                @{ type = 'creation' }
+                @{ type = 'deletion' }
+                @{ type = 'non_fast_forward' }
+                @{ type = 'update' }
+            )
+            bypass_actors = @(
+                @{
+                    actor_id    = [int]$AppId
+                    actor_type  = 'Integration'
+                    bypass_mode = 'always'
+                }
+            )
+        } | ConvertTo-Json -Depth 10
 
-        $InstallationId = $null
+        $created = $false
         if (-not $DryRun) {
-            $installation = Invoke-GhApi "repos/$FullRepo/installation" -Silent
-            $InstallationId = $installation?.id
+            try {
+                Invoke-GhApi "repos/$FullRepo/rulesets" -Method POST -Body $TagRulesetBody | Out-Null
+                $created = $true
+            } catch {
+                Write-Warn "Tag ruleset API creation failed — ensure the App is installed on this repo/org."
+            }
         } else {
-            $InstallationId = '<INSTALLATION_ID>'
+            Write-Dry "POST repos/$FullRepo/rulesets (tag ruleset, App bypass actor_id=$AppId)"
+            $created = $true
         }
 
-        if (-not $InstallationId) {
-            Write-Warn "Could not retrieve installation ID for App $AppId."
-            Write-Warn "Ensure the app is installed on ${FullRepo} before re-running."
-            Show-TagRulesetUiInstructions
+        if ($created) {
+            Write-OK "Tag ruleset created with GitHub App bypass (App ID $AppId)."
         } else {
-            Write-Info "Installation ID: $InstallationId — creating tag ruleset with App bypass ..."
-
-            $TagRulesetBody = @{
-                name        = $TagRulesetName
-                target      = 'tag'
-                enforcement = 'active'
-                conditions  = @{
-                    ref_name = @{ include = @('refs/tags/v*'); exclude = @() }
-                }
-                rules        = @( @{ type = 'creation' } )
-                bypass_actors = @(
-                    @{
-                        actor_id    = $InstallationId
-                        actor_type  = 'Integration'
-                        bypass_mode = 'always'
-                    }
-                )
-            } | ConvertTo-Json -Depth 10
-
-            $created = $false
-            if (-not $DryRun) {
-                try {
-                    Invoke-GhApi "repos/$FullRepo/rulesets" -Method POST -Body $TagRulesetBody | Out-Null
-                    $created = $true
-                } catch {
-                    Write-Warn "Tag ruleset API creation failed (may need admin:org scope)."
-                }
-            } else {
-                Write-Dry "POST repos/$FullRepo/rulesets (tag ruleset, App bypass actor_id=$InstallationId)"
-                $created = $true
-            }
-
-            if ($created) {
-                Write-OK "Tag ruleset created with GitHub App bypass (installation $InstallationId)."
-            } else {
-                Show-TagRulesetUiInstructions
-            }
+            Show-TagRulesetUiInstructions
         }
     } else {
         Write-Warn "Tag ruleset bypass for github-actions[bot] requires the GitHub UI."

scripts/setup-release.sh

@@ -200,53 +200,39 @@ if ruleset_exists "${TAG_RULESET_NAME}"; then
 else
   info "Configuring tag ruleset for v* ..."
 
-  if [[ "${TOKEN_TYPE}" == "app" && -n "${APP_ID}" && -n "${APP_PEM}" ]]; then
-    # ── Option A: GitHub App — get installation ID and use it as bypass actor ──
-    info "GitHub App detected — fetching installation ID..."
+  if [[ "${TOKEN_TYPE}" == "app" && -n "${APP_ID}" ]]; then
+    # ── Option A: GitHub App — use App ID directly as the Integration bypass actor ──
+    # The bypass actor actor_id for an Integration (GitHub App) is the App's numeric ID,
+    # NOT the installation ID. The App must be installed on the repo (or org) first.
+    info "GitHub App detected — creating tag ruleset with App ID ${APP_ID} as bypass actor..."
 
-    if [[ "${DRY_RUN}" == true ]]; then
-      dry "gh api repos/${FULL_REPO}/installation --jq '.id'"
-      INSTALLATION_ID="<INSTALLATION_ID>"
-    else
-      INSTALLATION_ID=$(gh api "repos/${FULL_REPO}/installation" --jq '.id' 2>/dev/null || true)
-    fi
-
-    if [[ -z "${INSTALLATION_ID}" || "${INSTALLATION_ID}" == "null" ]]; then
-      warning "Could not determine installation ID for GitHub App ${APP_ID}."
-      warning "Ensure the app is installed on the repository first."
-      warning "Falling back to UI instructions for tag ruleset."
-      _tag_ruleset_ui_instructions
-    else
-      info "Installation ID: ${INSTALLATION_ID} — creating tag ruleset with App bypass..."
-
-      TAG_RULESET_JSON=$(cat <<ENDJSON
+    TAG_RULESET_JSON=$(cat <<ENDJSON
 {
   "name": "Protect release tags",
   "target": "tag",
   "enforcement": "active",
   "conditions": {
     "ref_name": { "include": ["refs/tags/v*"], "exclude": [] }
   },
-  "rules": [{ "type": "creation" }],
+  "rules": [{ "type": "creation" }, { "type": "deletion" }, { "type": "non_fast_forward" }, { "type": "update" }],
   "bypass_actors": [{
-    "actor_id": ${INSTALLATION_ID},
+    "actor_id": ${APP_ID},
     "actor_type": "Integration",
     "bypass_mode": "always"
   }]
 }
 ENDJSON
 )
 
-      if [[ "${DRY_RUN}" == true ]]; then
-        dry "POST repos/${FULL_REPO}/rulesets  (tag ruleset with App bypass, actor_id=${INSTALLATION_ID})"
+    if [[ "${DRY_RUN}" == true ]]; then
+      dry "POST repos/${FULL_REPO}/rulesets  (tag ruleset with App bypass, actor_id=${APP_ID})"
+    else
+      if echo "${TAG_RULESET_JSON}" | gh api "repos/${FULL_REPO}/rulesets" \
+          --method POST --header "Content-Type: application/json" --input - > /dev/null 2>&1; then
+        success "Tag ruleset created with GitHub App bypass (App ID ${APP_ID})."
       else
-        if echo "${TAG_RULESET_JSON}" | gh api "repos/${FULL_REPO}/rulesets" \
-            --method POST --header "Content-Type: application/json" --input - > /dev/null 2>&1; then
-          success "Tag ruleset created with GitHub App bypass (installation ${INSTALLATION_ID})."
-        else
-          warning "Tag ruleset creation via API failed — admin:org scope may be required."
-          _tag_ruleset_ui_instructions
-        fi
+        warning "Tag ruleset creation via API failed — ensure the App is installed on this repo/org."
+        _tag_ruleset_ui_instructions
       fi
     fi