Pass the publishing app token to the release step (#661)

.github/workflows/publish.yml

@@ -73,7 +73,6 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-          token: ${{ steps.app-token.outputs.token }}
 
       - uses: ./.github/actions/ci-setup
         with:
@@ -85,4 +84,5 @@ jobs:
       - name: Publish to marketplace
         uses: ./
         with:
+          github-token: ${{ steps.app-token.outputs.token }}
           publish: pnpm release

.github/workflows/release-pr.yml

@@ -122,6 +122,13 @@ jobs:
       pull-requests: write # to comment on the pull request with the release result (changesets/action)
 
     steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # to push the release snapshot branch (release-pr.ts)
+
       - name: Check out repo
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -173,6 +180,8 @@ jobs:
 
       - name: Release snapshot version
         run: pnpm release:pr
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Add success reaction
         run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='rocket'

scripts/release-pr.ts

@@ -1,9 +1,21 @@
+import { Buffer } from "node:buffer";
 import path from "node:path";
 import { exec } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
 const releaseLine = "pr-release";
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -11,9 +23,10 @@ await exec("git", ["checkout", "--detach"]);
 await exec("git", ["add", "--force", "dist"]);
 await exec("git", ["commit", "-m", tag]);
 
-await exec("git", [
+await exec(
-  "push",
+  "git",
-  "--force",
+  ["push", "--force", "origin", `HEAD:refs/heads/${releaseLine}`],
-  "origin",
+  {
-  `HEAD:refs/heads/${releaseLine}`,
+    env: gitEnv,
-]);
+  },
+);

scripts/release.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import path from "node:path";
 import { exec, getExecOutput } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
@@ -5,6 +6,17 @@ import pkgJson from "../package.json" with { type: "json" };
 const tag = `v${pkgJson.version}`;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;
 const isPrerelease = pkgJson.version.includes("-");
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -33,15 +45,23 @@ process.chdir(path.join(import.meta.dirname, ".."));
   await exec("changeset", ["tag"]);
 
   if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`]);
+    await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+      env: gitEnv,
+    });
     return;
   }
 
-  await exec("git", [
+  await exec(
+    "git",
+    [
       "push",
       "--force",
       "--follow-tags",
       "origin",
       `HEAD:refs/heads/${releaseLine}`,
-  ]);
+    ],
+    {
+      env: gitEnv,
+    },
+  );
 })();