From 8e669a8807a5c7d31b65732c644ea96e6164e098 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 22 Oct 2026 09:43:32 +0000 Subject: [PATCH 1/2] ci(release): push releases with a short-lived GitHub App token Co-authored-by: Hassieb Pakzad --- .github/workflows/release.yml | 23 +++++++++++++++-------- CONTRIBUTING.md | 4 ++++ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 198fac2d5..4e611659f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ on: default: "" permissions: - contents: write + contents: read # Pushes and GitHub releases use the release GitHub App token id-token: write # Required for PyPI Trusted Publishing via OIDC concurrency: @@ -93,7 +93,6 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - token: ${{ secrets.GH_ACCESS_TOKEN }} persist-credentials: false - name: Install uv and set Python version @@ -104,15 +103,10 @@ jobs: enable-cache: false - name: Configure Git - env: - GH_ACCESS_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }} run: | git config user.name "langfuse-bot" git config user.email "langfuse-bot@langfuse.com" - echo "$GH_ACCESS_TOKEN" | gh auth login --with-token - gh auth setup-git - - name: Get current version id: current-version run: | @@ -316,13 +310,26 @@ jobs: env: STEPS_NEW_VERSION_OUTPUTS_VERSION: ${{ steps.new-version.outputs.version }} + # Minted after the build and smoke tests so build backends and test installs never + # see a write token. The App needs Contents read/write on this repo and must be + # allowed to bypass the main branch protection and the v* tag rulesets. + - name: Create release GitHub App token + id: release-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.RELEASE_APP_CLIENT_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + permission-contents: write + - name: Create and push tag id: push-tag run: | + gh auth setup-git git tag "v${STEPS_NEW_VERSION_OUTPUTS_VERSION}" git push origin "HEAD:${GITHUB_REF_NAME}" git push origin "v${STEPS_NEW_VERSION_OUTPUTS_VERSION}" env: + GH_TOKEN: ${{ steps.release-token.outputs.token }} STEPS_NEW_VERSION_OUTPUTS_VERSION: ${{ steps.new-version.outputs.version }} - name: Publish to PyPI @@ -341,7 +348,7 @@ jobs: $prerelease_flag \ dist/*.whl dist/*.tar.gz env: - GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }} + GH_TOKEN: ${{ steps.release-token.outputs.token }} VERSION: ${{ steps.new-version.outputs.version }} IS_PRERELEASE: ${{ steps.new-version.outputs.is_prerelease }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 51defd979..33144527d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -123,6 +123,10 @@ The workflow will automatically: - Publish to PyPI - Create a git tag and GitHub release with auto-generated release notes +Prerequisites: +- PyPI Trusted Publishing configured for `langfuse` with workflow `release.yml` and environment `protected branches` +- A release GitHub App installed on this repository with only Contents read/write. Its client ID is the `RELEASE_APP_CLIENT_ID` variable and its private key the `RELEASE_APP_PRIVATE_KEY` secret, both on the `protected branches` environment. The App must be allowed to bypass the `main` pull request requirement and push restriction, and the `v*` tag rulesets, because the workflow pushes the version commit and tag directly + ### SDK Reference Note: The generated SDK reference is currently work in progress. From 7b423f3d0ff85d030704950a1a4729a3c6eb7ad6 Mon Sep 17 00:00:00 2001 From: Hassieb Pakzad <68423100+hassiebp@users.noreply.github.com> Date: Thu, 22 Oct 2026 16:18:21 +0400 Subject: [PATCH 2/2] push --- .github/workflows/release.yml | 5 +---- CONTRIBUTING.md | 4 ---- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e611659f..0bfbebdf2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ on: default: "" permissions: - contents: read # Pushes and GitHub releases use the release GitHub App token + contents: read id-token: write # Required for PyPI Trusted Publishing via OIDC concurrency: @@ -310,9 +310,6 @@ jobs: env: STEPS_NEW_VERSION_OUTPUTS_VERSION: ${{ steps.new-version.outputs.version }} - # Minted after the build and smoke tests so build backends and test installs never - # see a write token. The App needs Contents read/write on this repo and must be - # allowed to bypass the main branch protection and the v* tag rulesets. - name: Create release GitHub App token id: release-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 33144527d..51defd979 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -123,10 +123,6 @@ The workflow will automatically: - Publish to PyPI - Create a git tag and GitHub release with auto-generated release notes -Prerequisites: -- PyPI Trusted Publishing configured for `langfuse` with workflow `release.yml` and environment `protected branches` -- A release GitHub App installed on this repository with only Contents read/write. Its client ID is the `RELEASE_APP_CLIENT_ID` variable and its private key the `RELEASE_APP_PRIVATE_KEY` secret, both on the `protected branches` environment. The App must be allowed to bypass the `main` pull request requirement and push restriction, and the `v*` tag rulesets, because the workflow pushes the version commit and tag directly - ### SDK Reference Note: The generated SDK reference is currently work in progress.