Skip to content

Replace user-based authentication with a GitHub App for release-related logic #79912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
desrosj merged 5 commits into from
Jul 7, 2026
Merged

Replace user-based authentication with a GitHub App for release-related logic #79912

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c38a9a6
Replace PAT-based authentication with a GitHub App
desrosj Jul 6, 2026
d1a1b95
Explicitly pass required permissions to app token.
desrosj Jul 6, 2026
ebdae40
Merge branch 'trunk' into switch-off-pat-to-gh-app
desrosj Jul 6, 2026
222e23f
Merge branch 'trunk' into switch-off-pat-to-gh-app
desrosj Jul 6, 2026
0e0fe3b
Merge branch 'trunk' into switch-off-pat-to-gh-app
desrosj Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 31 additions & 9 deletions .github/workflows/build-plugin-zip.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,7 @@ jobs:
bump-version:
name: Bump version
runs-on: 'ubuntu-24.04'
permissions:
contents: write
environment: 'GitHub Releases'
needs: compute-stable-branches
if: |
github.event_name == 'workflow_dispatch' && (
Expand All @@ -80,10 +79,18 @@ jobs:
trunk_commit: ${{ steps.commit_version_bump_to_trunk.outputs.version_bump_commit }}

steps:
- name: Generate application token

@tyxla tyxla Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice if we found a way not to duplicate this step, but it's not possible when generating a token, right?

@desrosj desrosj Jul 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are 3 steps generating a token, but only 2 are identical (only one grants permission-workflows: write capabilities).

While it would be nice to eliminate the similar steps, from a security perspective it's preferable to create a separate token whenever possible to guarantee the principle of least privilege is followed and tokens are properly scoped per-job.

uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
client-id: ${{ vars.APP_CLIENT_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
Comment thread
Copilot marked this conversation as resolved.
permission-contents: write
Comment thread
desrosj marked this conversation as resolved.

- name: Checkout code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
token: ${{ secrets.GUTENBERG_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
persist-credentials: true

Expand Down Expand Up @@ -345,20 +352,27 @@ jobs:
name: Revert version bump if build failed
needs: [bump-version, build]
runs-on: 'ubuntu-24.04'
permissions:
contents: write
environment: 'GitHub Releases'
if: |
always() &&
needs.build.result == 'failure' &&
needs.bump-version.outputs.release_branch_commit

steps:
- name: Generate application token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
client-id: ${{ vars.APP_CLIENT_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
Comment thread
Copilot marked this conversation as resolved.
permission-contents: write

- name: Checkout code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 2
ref: ${{ needs.bump-version.outputs.release_branch }}
token: ${{ secrets.GUTENBERG_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
persist-credentials: true

Expand Down Expand Up @@ -401,10 +415,18 @@ jobs:
name: Create Release Draft and Attach Asset
needs: [bump-version, build]
runs-on: 'ubuntu-24.04'
permissions:
contents: write
environment: 'GitHub Releases'
Comment thread
desrosj marked this conversation as resolved.

steps:
- name: Generate application token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
client-id: ${{ vars.APP_CLIENT_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
Comment thread
Copilot marked this conversation as resolved.
permission-contents: write
permission-workflows: write
Comment on lines +421 to +428

@ciampo ciampo Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Flagged by an AI agent while reviewing

[major] This still validates the critical workflows: write grant too late in the release path.

The PR moves release creation to a GitHub App token, which is the right credential direction. But the only step that requests permission-workflows: write is inside create-release, after bump-version has already pushed the version bump and after the ZIP build has run. If the App installation is missing the Workflows permission, or the environment vars/secrets point to the wrong App, this still fails at the same late phase where recovery is awkward.
That matters because the PR's stated root cause is the release API requiring workflows: write in this path. The earlier bump-version token only requests permission-contents: write, so it proves the App can push branches, but not that it can satisfy the release-creation permission that failed in #79803.
Could we add an explicit preflight before any version-bump mutation that mints the same release-capable App token?

Suggested shape

One option is to add a preflight step at the start of bump-version that requests both grants and does not persist that broader token into checkout:

- name: Verify release application token permissions
  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
      client-id: ${{ vars.APP_CLIENT_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      permission-contents: write
      permission-workflows: write

Then keep the existing contents-only token for checkout/push. That catches the permission/configuration failure before the workflow changes release/* or trunk, while avoiding a broader token being persisted in git credentials for the mutation steps.

@desrosj desrosj Jul 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a false positive.

The exact step where the original problem was encountered was the github.rest.repos.createRelease() call. Since everything else succeeded, no workflows: write permission is required in earlier steps.

@ciampo ciampo Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense, and I agree the earlier jobs don’t need workflows: write to run. My concern was slightly different: this only proves the workflows: write grant in create-release, after the version-bump jobs may already have pushed release/trunk commits.

If the App configuration is confirmed and expected to be stable, I’m fine treating this as an acceptable risk for this PR. The preflight suggestion was meant as a guardrail against App/environment misconfiguration, not because the earlier git-push steps themselves require workflows: write.


- name: Set Release Version
id: get_release_version
env:
Expand Down Expand Up @@ -433,7 +455,7 @@ jobs:
RELEASE_NAME: ${{ steps.get_release_version.outputs.version }}
VERSION: ${{ needs.bump-version.outputs.new_version }}
with:
github-token: ${{ secrets.GUTENBERG_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const fs = require('fs');

Expand Down
Loading