Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 904d4a7

Browse files
jdomeracki-coderjdomeracki-coder
authored
ci: use dedicated release App token to publish releases (backport 2.34) [ESR] (#28590)
Backport of #28553 to `release/2.34`. Use a dedicated GitHub App token (`secrets.RELEASE_APP_ID` / `secrets.RELEASE_APP_PRIVATE_KEY`) for the `Publish release` step instead of the default `GITHUB_TOKEN`. `gh release create` targets a release-branch commit that modifies files under `.github/workflows/` relative to the default branch. The create-release API requires the authenticating token to be authorized to modify workflows; the default `GITHUB_TOKEN` is not, so it fails with `HTTP 403: Resource not accessible by integration`. The `coder-release-publisher` App token has code + workflows write. Requires `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY` to be configured (already set on `coder/coder`). Refs coder/security-automation#297.
1 parent 23ed566 commit 904d4a7

1 file changed

Lines changed: 15 additions & 1 deletion

File tree

‎.github/workflows/release.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,18 @@ jobs:
553553
gcloud storage cp "./build/${detached_signature}" "gs://releases.coder.com/coder-cli/${version}/${cli_name}.asc"
554554
done
555555
556+
# Mint a short-lived installation token from the dedicated release
557+
# GitHub App. The default GITHUB_TOKEN (github-actions[bot]) cannot be
558+
# added to the "Auto-imported tag create protections" ruleset bypass
559+
# list, so `gh release create` fails to create the tag with a 403. The
560+
# App is added to that ruleset's bypass list as an Integration actor.
561+
- name: Generate release App token
562+
id: release_app_token
563+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
564+
with:
565+
app-id: ${{ secrets.RELEASE_APP_ID }}
566+
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
567+
556568
- name: Publish release
557569
run: |
558570
set -euo pipefail
@@ -591,7 +603,9 @@ jobs:
591603
--release-notes-file "$CODER_RELEASE_NOTES_FILE" \
592604
"${files[@]}"
593605
env:
594-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
606+
# Use the dedicated release App token (github-actions[bot] is blocked
607+
# from creating tags by the tag-create protection ruleset).
608+
GITHUB_TOKEN: ${{ steps.release_app_token.outputs.token }}
595609
CODER_GPG_RELEASE_KEY_BASE64: ${{ secrets.GPG_RELEASE_KEY_BASE64 }}
596610
VERSION: ${{ steps.version.outputs.version }}
597611
CREATED_LATEST_TAG: ${{ steps.build_docker.outputs.created_latest_tag }}

0 commit comments

Comments
 (0)