From 16e934e2e3849910c4686ab3cfc2c9e60712fec9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 27 Oct 2026 21:36:26 +0000 Subject: [PATCH 1/2] Initial plan From bfc7e7e903b0a66775e5917722bbfd787a075aae Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 27 Oct 2026 21:45:17 +0000 Subject: [PATCH 2/2] Use app token for release summary updates Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- .github/workflows/publish.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 731cc0ad..028195b4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -386,7 +386,7 @@ jobs: runs-on: ubuntu-latest permissions: - contents: write + contents: read steps: - uses: actions/checkout@v7 @@ -415,6 +415,15 @@ jobs: .github/scripts/build-codeql-lib-versions-table.sh > codeql-lib-versions.md cat codeql-lib-versions.md >> "$GITHUB_STEP_SUMMARY" + - name: Create release token + if: github.event_name == 'push' + id: release_token + uses: actions/create-github-app-token@v3 + with: + app-id: ${{ secrets.SECLABS_APP_ID }} + private-key: ${{ secrets.SECLABS_APP_KEY }} + permission-contents: write + - name: Upsert release table # Only the release-cut path (push to .release.yml) should touch a GitHub Release's # notes. A workflow_dispatch run is often a one-off hotfix publish for a single pack @@ -423,7 +432,7 @@ jobs: # misleadingly overwrite its notes with a summary of an unrelated hotfix run. if: github.event_name == 'push' env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.release_token.outputs.token }} run: | .github/scripts/upsert-release-table.sh summary.md publish-summary .github/scripts/upsert-release-table.sh codeql-lib-versions.md codeql-lib-versions