From 4f5e6f604fd98ac46092b5301adf8ca86c60fdec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9o=20LAGACHE?= Date: Mon, 14 Sep 2026 16:12:17 +0200 Subject: [PATCH] fix --- .github/CONTRIBUTING.md | 4 ++-- .github/workflows/bump.yml | 9 ++++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 735b9dc..b5916c9 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -254,8 +254,8 @@ Releases are cut from GitHub Actions, never from a local machine. 1. Open **Actions → Bump version → Run workflow**. 2. Pick the branch (`main` for stable, any branch for a release candidate). 3. Enter the version without a leading `v` (`26.09.0` for stable, `26.09.0rc1` for a candidate) and the matching channel. -4. The workflow commits `chore(release): `, creates the tag and pushes. The tag triggers the build, the GitHub release, the Discord notification and the template upload. +4. The workflow commits `chore(release): `, creates the tag and pushes. The tag triggers the build, the GitHub release and the Discord notification. Stable versions must match `X.Y.Z` and can only be cut from `main`. -The workflow pushes with the `RELEASE_TOKEN` repository secret (a fine-grained PAT with *Contents: read and write*). A tag pushed with the default `GITHUB_TOKEN` would not trigger the release workflows. +The workflow pushes with a token minted from the Portabase GitHub App (`APP_ID` repository variable, `APP_PRIVATE_KEY` secret), scoped to *Contents: write*. The app must be installed on this repository and allowed to push to `main`. A tag pushed with the default `GITHUB_TOKEN` would not trigger the release workflows. diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml index f8fe0f8..9a71216 100644 --- a/.github/workflows/bump.yml +++ b/.github/workflows/bump.yml @@ -23,10 +23,17 @@ jobs: permissions: contents: write steps: + - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + id: app-token + with: + app-id: ${{ vars.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - token: ${{ secrets.RELEASE_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - name: Validate version against channel env: