From 8b2e6de27e34b27b617e9a05deb9a84d68fcefa3 Mon Sep 17 00:00:00 2001 From: Arbian Shkodra Date: Fri, 30 Oct 2026 17:05:28 +0100 Subject: [PATCH] ci(repo): mint the release token from the GitHub App Release Please ran on a personal access token that no longer exists, so the merged release PR cut no tag and nothing published (Bad credentials). The token now comes from the sent-dm-sdk-pipeline App, as the seal dispatch's already does; the old secret stays as a fallback until it is removed. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release-please.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 2d6a600b8..c84873072 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -12,9 +12,25 @@ jobs: release-please: if: github.repository == 'sentdm/sent-dm-java' runs-on: ubuntu-latest + env: + HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }} steps: + - name: Mint the release token from the GitHub App + # A tag or release created with the built-in token starts no + # workflow, so the publish workflow would never run; a personal + # access token expires or dies with its owner's account. The App's + # token does neither. + id: app + if: env.HAS_APP == 'true' + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0 + with: + app-id: ${{ secrets.SDK_APP_ID }} + private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }} + owner: sentdm + repositories: ${{ github.event.repository.name }} + - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1 id: release with: - token: ${{ secrets.RELEASE_PLEASE_TOKEN }} + token: ${{ steps.app.outputs.token || secrets.RELEASE_PLEASE_TOKEN }}