ci: use release bot for CLI publishing

Author: altaywtf

.github/workflows/backfill-release-assets.yml

@@ -32,6 +32,7 @@ jobs:
       - validate-release-tag
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
+    environment: release
     permissions:
       contents: write
     strategy:
@@ -46,6 +47,13 @@ jobs:
             asset_arch: arm64
 
     steps:
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -96,6 +104,7 @@ jobs:
       - name: Upload binary assets to the GitHub release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
+          token: ${{ steps.release-bot.outputs.token }}
           tag_name: ${{ inputs.tag_name }}
           files: |
             .artifacts/release/*
@@ -106,10 +115,18 @@ jobs:
       - validate-release-tag
     runs-on: windows-latest
     timeout-minutes: 30
+    environment: release
     permissions:
       contents: write
 
     steps:
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -155,6 +172,7 @@ jobs:
       - name: Upload binary assets to the GitHub release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
+          token: ${{ steps.release-bot.outputs.token }}
           tag_name: ${{ inputs.tag_name }}
           files: |
             .artifacts/release/*

.github/workflows/ci.yml

@@ -60,10 +60,20 @@ jobs:
       new_release_version: ${{ steps.semantic.outputs.new_release_version }}
 
     steps:
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          token: ${{ steps.release-bot.outputs.token }}
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -91,12 +101,12 @@ jobs:
             @semantic-release/git
             conventional-changelog-conventionalcommits
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.release-bot.outputs.token }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GIT_AUTHOR_NAME: devsputio
-          GIT_AUTHOR_EMAIL: devs@put.io
-          GIT_COMMITTER_NAME: devsputio
-          GIT_COMMITTER_EMAIL: devs@put.io
+          GIT_AUTHOR_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
+          GIT_AUTHOR_EMAIL: ${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot]
+          GIT_COMMITTER_EMAIL: ${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
 
   build-unix-binaries:
     if: needs.release.outputs.new_release_published == 'true'
@@ -105,6 +115,7 @@ jobs:
       - release
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
+    environment: release
     permissions:
       contents: write
     strategy:
@@ -119,6 +130,13 @@ jobs:
             asset_arch: arm64
 
     steps:
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -167,6 +185,7 @@ jobs:
       - name: Upload binary assets to the GitHub release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
+          token: ${{ steps.release-bot.outputs.token }}
           tag_name: ${{ needs.release.outputs.new_release_git_tag }}
           files: |
             .artifacts/release/*
@@ -178,10 +197,18 @@ jobs:
       - release
     runs-on: windows-latest
     timeout-minutes: 30
+    environment: release
     permissions:
       contents: write
 
     steps:
+      - name: Create release bot token
+        id: release-bot
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        with:
+          app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -225,6 +252,7 @@ jobs:
       - name: Upload binary assets to the GitHub release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
+          token: ${{ steps.release-bot.outputs.token }}
           tag_name: ${{ needs.release.outputs.new_release_git_tag }}
           files: |
             .artifacts/release/*

CONTRIBUTING.md

@@ -47,6 +47,14 @@ pnpm run build:sea
 pnpm run verify:sea
 ```
 
+## Release Publishing
+
+GitHub Actions publishes from `main` through the protected `release` Environment.
+
+Keep `NPM_TOKEN`, `PUTIO_RELEASE_BOT_APP_ID`, and `PUTIO_RELEASE_BOT_PRIVATE_KEY` in that Environment with required reviewers and prevent self-review enabled. Pull request checks stay secretless and only run verify jobs.
+
+Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, and binary asset uploads. Trusted put.io team members may push directly to `main`, but repository rules should block outsiders, force-pushes, and branch deletes where GitHub plan support allows.
+
 ## Development Notes
 
 - `verify` is the repository delivery gate.