From dad5baf18b70c13a1160479bfb6b3ec78a5a7b14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Tue, 23 Jun 2026 09:31:13 +0200
Subject: [PATCH] Pass the publishing app token to the release step (#661)

---
 .github/workflows/publish.yml    |  2 +-
 .github/workflows/release-pr.yml |  9 ++++++++
 scripts/release-pr.ts            | 25 ++++++++++++++++------
 scripts/release.ts               | 36 +++++++++++++++++++++++++-------
 4 files changed, 57 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 59f7468..bb8ca1a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -73,7 +73,6 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-          token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup
         with:
@@ -85,4 +84,5 @@ jobs:
       - name: Publish to marketplace
         uses: ./
         with:
+          github-token: ${{ steps.app-token.outputs.token }}
           publish: pnpm release
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 4a42efb..6f71c1c 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -122,6 +122,13 @@ jobs:
       pull-requests: write # to comment on the pull request with the release result (changesets/action)
 
     steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to push the release snapshot branch (release-pr.ts)
+
       - name: Check out repo
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -173,6 +180,8 @@ jobs:
 
       - name: Release snapshot version
         run: pnpm release:pr
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Add success reaction
         run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='rocket'
diff --git a/scripts/release-pr.ts b/scripts/release-pr.ts
index 715bdff..68b8264 100644
--- a/scripts/release-pr.ts
+++ b/scripts/release-pr.ts
@@ -1,9 +1,21 @@
+import { Buffer } from "node:buffer";
 import path from "node:path";
 import { exec } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
 const releaseLine = "pr-release";
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -11,9 +23,10 @@ await exec("git", ["checkout", "--detach"]);
 await exec("git", ["add", "--force", "dist"]);
 await exec("git", ["commit", "-m", tag]);
 
-await exec("git", [
-  "push",
-  "--force",
-  "origin",
-  `HEAD:refs/heads/${releaseLine}`,
-]);
+await exec(
+  "git",
+  ["push", "--force", "origin", `HEAD:refs/heads/${releaseLine}`],
+  {
+    env: gitEnv,
+  },
+);
diff --git a/scripts/release.ts b/scripts/release.ts
index 314319f..a8304ef 100644
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import path from "node:path";
 import { exec, getExecOutput } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
@@ -5,6 +6,17 @@ import pkgJson from "../package.json" with { type: "json" };
 const tag = `v${pkgJson.version}`;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;
 const isPrerelease = pkgJson.version.includes("-");
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -33,15 +45,23 @@ process.chdir(path.join(import.meta.dirname, ".."));
   await exec("changeset", ["tag"]);
 
   if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`]);
+    await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+      env: gitEnv,
+    });
     return;
   }
 
-  await exec("git", [
-    "push",
-    "--force",
-    "--follow-tags",
-    "origin",
-    `HEAD:refs/heads/${releaseLine}`,
-  ]);
+  await exec(
+    "git",
+    [
+      "push",
+      "--force",
+      "--follow-tags",
+      "origin",
+      `HEAD:refs/heads/${releaseLine}`,
+    ],
+    {
+      env: gitEnv,
+    },
+  );
 })();