Skip to content

ci: use dedicated release App token to publish releases (backport 2.35) #28554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtojek merged 2 commits into from
Aug 25, 2026
Merged

ci: use dedicated release App token to publish releases (backport 2.35) #28554

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2aca902
ci: use dedicated release App token to publish releases
jdomeracki-coder Aug 25, 2026
fe92be7
ci: store RELEASE_APP_ID as a secret instead of a variable
jdomeracki-coder Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -540,6 +540,18 @@ jobs:
gcloud storage cp "./build/${detached_signature}" "gs://releases.coder.com/coder-cli/${version}/${cli_name}.asc"
done

# Mint a short-lived installation token from the dedicated release
# GitHub App. The default GITHUB_TOKEN (github-actions[bot]) cannot be
# added to the "Auto-imported tag create protections" ruleset bypass
# list, so `gh release create` fails to create the tag with a 403. The
# App is added to that ruleset's bypass list as an Integration actor.
- name: Generate release App token
id: release_app_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.RELEASE_APP_ID }}
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

- name: Publish release
run: |
set -euo pipefail
Expand Down Expand Up @@ -578,7 +590,9 @@ jobs:
--release-notes-file "$CODER_RELEASE_NOTES_FILE" \
"${files[@]}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Use the dedicated release App token (github-actions[bot] is blocked
# from creating tags by the tag-create protection ruleset).
GITHUB_TOKEN: ${{ steps.release_app_token.outputs.token }}
CODER_GPG_RELEASE_KEY_BASE64: ${{ secrets.GPG_RELEASE_KEY_BASE64 }}
VERSION: ${{ steps.version.outputs.version }}
CREATED_LATEST_TAG: ${{ steps.build_docker.outputs.created_latest_tag }}
Expand Down
Loading