Skip to content

ci: scope release GitHub App token#81

Merged
Boshen merged 1 commit intomainfrom
codex/fix-release-app-token-scope
Apr 22, 2026
Merged

ci: scope release GitHub App token#81
Boshen merged 1 commit intomainfrom
codex/fix-release-app-token-scope

Conversation

@Boshen
Copy link
Copy Markdown
Member

@Boshen Boshen commented Apr 22, 2026

Summary

  • keep the release workflow on actions/create-github-app-token
  • scope the generated token through the repository owner installation and back to notify
  • request only the contents and pull request permissions needed by release-plz

Why

The release job failed before checkout because actions/create-github-app-token defaulted to the current repository lookup and GitHub returned 404 for /repos/rolldown/notify/installation. Setting owner and repositories makes the action create the token from the owner installation instead of relying on the repository-installation lookup path.

Verification

  • ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "ok"'
  • git diff --check -- .github/workflows/release.yml

actionlint is not installed locally, so it was not run.

@Boshen Boshen merged commit 588c5ab into main Apr 22, 2026
9 of 10 checks passed
@Boshen Boshen deleted the codex/fix-release-app-token-scope branch April 22, 2026 05:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant