From 5db310a1a0fa9d836ad2f9c0d602b0ef5950eee8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20Str=C3=BCbe?= Date: Fri, 16 Oct 2026 15:04:07 +0200 Subject: [PATCH] ci: use GitHub app token for 0.x releases instead of PAT (FB-4891) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-v0.yml | 10 +++++++++- .github/workflows/release.yml | 11 ++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-v0.yml b/.github/workflows/release-v0.yml index 6175da5a1ae..4f3d76f9abc 100644 --- a/.github/workflows/release-v0.yml +++ b/.github/workflows/release-v0.yml @@ -29,12 +29,20 @@ jobs: contents: write needs: integration-tests steps: + - name: Create GitHub App token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ secrets.GH_APP_FB_DB_CI_WRITER_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_FB_DB_CI_WRITER_APP_KEY_PEM }} + permission-contents: write + - name: Check out code uses: actions/checkout@v2 with: fetch-depth: 0 ref: 0.x - token: ${{ secrets.RELEASE_PAT }} + token: ${{ steps.app-token.outputs.token }} - name: 'Publish action' uses: firebolt-db/action-python-release@main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b79719b9178..70a72b708c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,11 +25,19 @@ jobs: contents: write needs: integration-tests steps: + - name: Create GitHub App token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ secrets.GH_APP_FB_DB_CI_WRITER_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_FB_DB_CI_WRITER_APP_KEY_PEM }} + permission-contents: write + - name: Check out code uses: actions/checkout@v2 with: fetch-depth: 0 - token: ${{ secrets.RELEASE_PAT }} + token: ${{ steps.app-token.outputs.token }} - name: 'Publish action' uses: firebolt-db/action-python-release@main @@ -39,3 +47,4 @@ jobs: pypi-username: ${{ secrets.PYPI_USERNAME }} pypi-password: ${{ secrets.PYPI_PASSWORD }} version-file-path: "src/firebolt/__init__.py" + main-branch: 0.x