From 71a1a9574e14e6eea6ecf180c9be920765cc8553 Mon Sep 17 00:00:00 2001 From: mbruzda Date: Fri, 17 Apr 2026 15:00:32 +0200 Subject: [PATCH] ci: migrate GH_TOKEN_ADMIN to GitHub App token Replace the long-lived PAT with a short-lived GitHub App installation token generated by actions/create-github-app-token@v3 for the semantic-release step. Made-with: Cursor --- .github/workflows/build-test-release.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml index b1fe2d0..310c8cd 100644 --- a/.github/workflows/build-test-release.yml +++ b/.github/workflows/build-test-release.yml @@ -74,6 +74,13 @@ jobs: # Very important: semantic-release won't trigger a tagged # build if this is not set false persist-credentials: false + - name: Generate GitHub App Token + id: app-token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/setup-python@v5 with: python-version: "3.9" @@ -91,7 +98,7 @@ jobs: extra_plugins: | semantic-release-replace-plugin env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} - if: ${{ steps.semantic.outputs.new_release_published == 'true' }} run: | poetry build