ci: authenticate release-please via GitHub App token - #292
Merged
Conversation
REPO_GHA_PAT was last rotated in 2021 and now returns 'Bad credentials', blocking release PR creation. Switch to the org-level GitHub App (BEE_RUNNER_CLIENT_ID + BEE_RUNNER_KEY) using actions/create-github-app-token so release-please runs on a token that doesn't need manual rotation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Cafe137
approved these changes
May 19, 2026
Collaborator
|
@darkobas / @darkobas2 please let me know when this repository is on the allowlist, I'll merge after that |
Contributor
Author
|
Yeah its done. Lets try it |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
release.yamlcallsgoogleapis/release-please-action@v4withsecrets.REPO_GHA_PAT, last rotated 2021-11-09. The token now returnsBad credentialsfrom the GitHub API (failing run), so no release PRs are being created.Fix
Generate a fresh GitHub App token at workflow runtime using
actions/create-github-app-token@v1with the org-levelBEE_RUNNER_CLIENT_ID+BEE_RUNNER_KEYsecrets, and pass that into release-please. Same pattern as ethersphere/create-swarm-app#13.Prerequisite
BEE_RUNNER_KEYis currently shared at the org level only with selected repos. An org admin needs to addbee-factoryto its repository allowlist (Settings → Secrets and variables → Actions →BEE_RUNNER_KEY→ repository access).BEE_RUNNER_CLIENT_IDis already visible to this repo.After that grant, the next push to
mastershould run release-please successfully.🤖 Generated with Claude Code