From e1cf250f8fbf338c2a4c1ae381cb91ebe73bd334 Mon Sep 17 00:00:00 2001 From: mbruzda Date: Fri, 17 Jul 2026 11:58:09 +0200 Subject: [PATCH] chore: migrate publish job from PAT to GitHub App authentication Replace GH_TOKEN_ADMIN (service account PAT) with a short-lived token generated from GH_APP_CLIENT_ID/GH_APP_PRIVATE_KEY, consistent with how all other jobs in this workflow already authenticate. - Remove GH_TOKEN_ADMIN from the workflow_call secrets block - Add Generate app token step at the start of the publish job - Pass steps.app-token.outputs.token to semantic-release and action-gh-release instead of the PAT Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/reusable-build-test-release.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/reusable-build-test-release.yml b/.github/workflows/reusable-build-test-release.yml index d1a6f379..c8c15092 100644 --- a/.github/workflows/reusable-build-test-release.yml +++ b/.github/workflows/reusable-build-test-release.yml @@ -83,9 +83,6 @@ on: type: string default: "[]" secrets: - GH_TOKEN_ADMIN: - description: Github admin token - required: true GH_APP_CLIENT_ID: description: GitHub App Client ID for authentication required: true @@ -3495,6 +3492,13 @@ jobs: pull-requests: read statuses: write steps: + - name: Generate app token + id: app-token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - name: Checkout uses: actions/checkout@v5 with: @@ -3505,7 +3509,7 @@ jobs: id: semantic uses: splunk/semantic-release-action@v1.3 env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} with: git_committer_name: ${{ secrets.SA_GH_USER_NAME }} git_committer_email: ${{ secrets.SA_GH_USER_EMAIL }} @@ -3516,7 +3520,7 @@ jobs: id: custom uses: "softprops/action-gh-release@v3" with: - token: "${{ secrets.GH_TOKEN_ADMIN }}" + token: "${{ steps.app-token.outputs.token }}" tag_name: v${{ github.event.inputs.custom-version }} target_commitish: "${{github.ref_name}}" make_latest: false