Skip to content

build(security): use GitHub App token for release push#2342

Merged
kevinmessiaen merged 1 commit intomainfrom
chore/release-app-token
Mar 26, 2026
Merged

build(security): use GitHub App token for release push#2342
kevinmessiaen merged 1 commit intomainfrom
chore/release-app-token

Conversation

@Hartorn
Copy link
Copy Markdown
Member

@Hartorn Hartorn commented Mar 26, 2026 •
edited
Loading

Summary

  • Add actions/create-github-app-token step to generate a short-lived token from the giskard-oss-release GitHub App
  • Use the app token (instead of github.token) for pushing version bump commits and tags to main, bypassing branch protection
  • Token is scoped to Contents: write only, expires in 1 hour, and is not persisted on disk

Prerequisites

  • GitHub App giskard-oss-release created (ID: 3190683)
  • App added to main branch protection bypass list
  • RELEASE_APP_ID variable set in release environment
  • RELEASE_APP_PRIVATE_KEY secret set in release environment

After merging

  • Delete RELEASE_PAT_TOKEN from org secrets
  • Run a dry-run release to verify the flow works

Made with Cursor

build(security): use GitHub App token for release push
3e0e094 
Replace github.token with a short-lived GitHub App token that can
bypass branch protection to push version bump commits and tags to main.

Made-with: Cursor
@Hartorn Hartorn requested a review from a team as a code owner March 26, 2026 08:58
@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist bot commented Mar 26, 2026

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

@kevinmessiaen kevinmessiaen merged commit 3d4da33 into main Mar 26, 2026
24 checks passed
@kevinmessiaen kevinmessiaen deleted the chore/release-app-token branch March 26, 2026 09:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevinmessiaen kevinmessiaen kevinmessiaen approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Hartorn @kevinmessiaen