From d3fe185027758ab4c54c249d86cb2540c58007c0 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sun, 13 Sep 2026 16:43:36 +0100 Subject: [PATCH] diag(release): log the app-slug the release token authenticates as The main-protection ruleset's bypass_actors entry only recognises app ID 1008913 (slug "exadev"). The release job's git push is being rejected as a rule violation despite that entry existing, which is consistent with secrets.APP_ID/APP_PRIVATE_KEY authenticating as a different app than expected. Logging the token's own app-slug output confirms which app is actually performing the push. --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a5a771..2123bd1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -135,6 +135,10 @@ jobs: owner: ExaDev repositories: cc-peer + # Diagnostic: identifies which App actually authenticated the token below, since the main-protection ruleset's bypass_actors entry only recognises app ID 1008913 (slug "exadev") and a mismatched secret would authenticate fine while silently failing the later bypass check. + - name: Diagnose app token identity + run: echo "authenticated as app-slug=${{ steps.app-token.outputs.app-slug }}" + - uses: actions/checkout@v5 with: token: ${{ steps.app-token.outputs.token }}