ci(release): mint the release token from a GitHub App

[JohnMcLear]

The release workflow checks out etherpad and ether.github.com with the ETHER_RELEASE_TOKEN PAT. That PAT expired, and the 3.3.9 release (run 39124316513) failed at the first checkout with Bad credentials. Rotating a PAT every month isn't sustainable.

This adds an actions/create-github-app-token step. It mints a short-lived installation token from an "Etherpad Release Bot" GitHub App, and both checkouts use that token. App credentials don't expire. Until the RELEASE_APP_ID repo variable exists, the step is skipped and the checkouts fall back to the PAT, so merging this changes nothing on its own.

The built-in GITHUB_TOKEN isn't an option. Tags pushed with it don't trigger handleRelease, Docker, .deb or snap.

One-off setup (an org owner):

1. github.com/organizations/ether/settings/apps/new. Name: Etherpad Release Bot. Homepage: https://etherpad.org. Untick Webhook "Active". Repository permissions: Contents read/write, Workflows read/write, Metadata read. "Only on this account". Create.
2. On the app page, note the App ID. Then Private keys → Generate a private key, which downloads a .pem.
3. Install App → ether → Only select repositories: etherpad, ether.github.com.
4. In ether/etherpad → Settings → Secrets and variables → Actions, add the variable RELEASE_APP_ID = the App ID, and the secret RELEASE_APP_PRIVATE_KEY = the full .pem contents.
5. Add the app to the bypass list of the develop: required backend checks ruleset. The release pushes straight to develop.

After that, ETHER_RELEASE_TOKEN can be deleted.

Tests: the YAML parses. The app path only runs on a release dispatch, so it gets exercised on the first release after setup. The PAT fallback keeps behaviour unchanged until then.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y5YroE8t1VhXCVTjJhx2kU

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Use a GitHub App token for release checkouts

⚙️ Configuration changes 🐞 Bug fix 🕐 10-20 Minutes

AI Description

• Mint a short-lived GitHub App token to replace the expiring release PAT during checkouts.
• Retain the PAT fallback until the App ID is configured, preserving existing release behavior.

Diagram

graph TD
  A["Release dispatch"] --> B{"App ID set?"} -->|Yes| C["App token"] --> E["Source checkout"] --> F["Site checkout"] --> G["Release push"]
  B -->|No| D["PAT fallback"] --> E
  C --> F
  D --> F

Loading

High-Level Assessment

A GitHub App token with a PAT fallback is appropriate: it avoids routine PAT rotation while preserving behavior until setup. Before enabling the App path, resolve the repository-scope mismatch: the token requests etherpad, but the workflow checks out ether/etherpad-lite. If those are distinct repositories, the new token will not authorize that checkout.

Files changed (1) +16 / -2

Other (1) +16 / -2

release.ymlPrefer a GitHub App token for both release checkouts +16/-2

Prefer a GitHub App token for both release checkouts

• Adds conditional installation-token creation using the release App ID and private key. Both checkouts use that token when available and otherwise retain the existing PAT.

.github/workflows/release.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Releases fail after the app is enabled ✓ Resolved

Description

The app-token step requests access to etherpad but not etherpad-lite, which is the repository
the first checkout uses. Once RELEASE_APP_ID is set, that checkout prefers the app token over the
PAT, so it cannot authenticate and the release never reaches its tag pushes.

Code

.github/workflows/release.yml[37]

+          repositories: etherpad,ether.github.com

Evidence

The requested token covers etherpad and ether.github.com, while the first checkout explicitly
targets ether/etherpad-lite and selects the app token when it exists. The release script later
pushes branches and tags from that checkout.

.github/workflows/release.yml[29-43]
bin/push-after-release.sh[13-16]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The app token excludes the repository checked out and pushed by the release job.
## Fix Focus Areas
- .github/workflows/release.yml[33-43]
## Recommended Fix
Request `etherpad-lite` instead of `etherpad` in the token step's repository list, and ensure the release app is installed on `ether/etherpad-lite` with write access.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can move or hide resolved findings to focus on what still needs action

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗