From f5f168bc1e6dc95c4ee584b72c181ce717e62cb8 Mon Sep 17 00:00:00 2001
From: Jakub Domeracki <jakub@coder.com>
Date: Tue, 25 Aug 2026 13:59:29 +0000
Subject: [PATCH 1/3] ci: use dedicated release App token to publish releases

The Publish release step runs gh release create, which creates the
v$version tag in addition to the release. The active tag-create
protection ruleset blocks github-actions[bot] (the default GITHUB_TOKEN),
producing HTTP 403: Resource not accessible by integration.

Mint an installation token from a dedicated release GitHub App
(RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY) and use it only for the
Publish release step. The App is added to the ruleset bypass list as an
Integration actor.

Refs coder/security-automation#297
---
 .github/workflows/release.yaml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 95690adb25f0d..74dfeda9da7b5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -541,6 +541,18 @@ jobs:
             gcloud storage cp "./build/${detached_signature}" "gs://releases.coder.com/coder-cli/${version}/${cli_name}.asc"
           done
 
+      # Mint a short-lived installation token from the dedicated release
+      # GitHub App. The default GITHUB_TOKEN (github-actions[bot]) cannot be
+      # added to the "Auto-imported tag create protections" ruleset bypass
+      # list, so `gh release create` fails to create the tag with a 403. The
+      # App is added to that ruleset's bypass list as an Integration actor.
+      - name: Generate release App token
+        id: release_app_token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - name: Publish release
         run: |
           set -euo pipefail
@@ -579,7 +591,9 @@ jobs:
             --release-notes-file "$CODER_RELEASE_NOTES_FILE" \
             "${files[@]}"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Use the dedicated release App token (github-actions[bot] is blocked
+          # from creating tags by the tag-create protection ruleset).
+          GITHUB_TOKEN: ${{ steps.release_app_token.outputs.token }}
           CODER_GPG_RELEASE_KEY_BASE64: ${{ secrets.GPG_RELEASE_KEY_BASE64 }}
           VERSION: ${{ steps.version.outputs.version }}
           CREATED_LATEST_TAG: ${{ steps.build_docker.outputs.created_latest_tag }}

From c0925d3818ae54b1a67bd0db24b91172ff6c02ee Mon Sep 17 00:00:00 2001
From: Jakub Domeracki <jakub@coder.com>
Date: Tue, 25 Aug 2026 14:10:16 +0000
Subject: [PATCH 2/3] ci: store RELEASE_APP_ID as a secret instead of a
 variable

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 74dfeda9da7b5..d8e610941fce8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -550,7 +550,7 @@ jobs:
         id: release_app_token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.RELEASE_APP_ID }}
+          app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Publish release

From 0bd9e945ee598a39477a272c2d57483b83315354 Mon Sep 17 00:00:00 2001
From: Jakub Domeracki <jakub@coder.com>
Date: Tue, 25 Aug 2026 15:06:55 +0000
Subject: [PATCH 3/3] ci: resolve org installation for release App token

The action defaulted to a per-repo installation lookup
(GET /repos/coder/coder/installation), which 404s when the App is
installed at the org level. Set owner/repositories so it resolves the
org installation.
---
 .github/workflows/release.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d8e610941fce8..6e93dec7ea047 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -552,6 +552,10 @@ jobs:
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          # The App is installed at the org level, so resolve the org
+          # installation (avoids a 404 on the per-repo installation lookup).
+          owner: ${{ github.repository_owner }}
+          repositories: coder
 
       - name: Publish release
         run: |