From 65e05128a92ab28ba04cbd823e5ab4f431d7d330 Mon Sep 17 00:00:00 2001 From: Eric Kim Date: Wed, 29 Jul 2026 17:29:07 -0400 Subject: [PATCH] fix: read GitHub App secrets from npm-release environment AMPLITUDE_DEV_EXP_* are environment secrets (see Amplitude-TypeScript), not repo/org secrets. Attach release-please job to npm-release so the app token step can resolve them once infra copies the values in. Co-authored-by: Cursor --- .github/workflows/release-please.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 8fe3f24..55592f9 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -14,14 +14,17 @@ permissions: jobs: release-please: runs-on: ubuntu-24.04 + # AMPLITUDE_DEV_EXP_* live on the npm-release environment (same as + # Amplitude-TypeScript publish-v2.yml), not repo/org secrets. + environment: npm-release outputs: releases_created: ${{ steps.release.outputs.releases_created }} steps: # Mint a GitHub App installation token so release-please's PRs trigger # downstream workflows (GITHUB_TOKEN-authored events do not, by design, # which would leave required checks unrun and the Release PR BLOCKED). - # Org secrets (shared with Amplitude-TypeScript / wizard release automation). - # Infra must grant amplitude/developer-cli access to these org secrets. + # Requires AMPLITUDE_DEV_EXP_APP_ID + AMPLITUDE_DEV_EXP_PRIVATE_KEY on the + # npm-release environment (infra copies from Amplitude-TypeScript). - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 id: app-token with: