From 1ab75913f1ba78fcf4fc8215b17833f534433cd6 Mon Sep 17 00:00:00 2001 From: John McLear Date: Sun, 18 Oct 2026 13:05:31 +0100 Subject: [PATCH 1/2] ci(release): mint the release token from a GitHub App The release workflow checked out etherpad and ether.github.com with the ETHER_RELEASE_TOKEN PAT. PATs expire, and when it did the 3.3.9 release failed at the first checkout with 'Bad credentials'. Prefer a short-lived installation token from a GitHub App (credentials don't expire), falling back to the PAT until the RELEASE_APP_ID variable is set. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y5YroE8t1VhXCVTjJhx2kU --- .github/workflows/release.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 69ad9d93345..e005dde3e3c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,12 +21,26 @@ jobs: releases: runs-on: ubuntu-latest steps: + # Prefer a short-lived token from the "Etherpad Release Bot" GitHub App: + # app credentials don't expire, unlike the ETHER_RELEASE_TOKEN PAT. Until + # the RELEASE_APP_ID variable is set this step is skipped and the PAT is + # used. The built-in GITHUB_TOKEN won't do: tags pushed with it don't + # trigger the Docker, .deb, snap and GitHub Release workflows. + - name: Get release token from GitHub App + id: app-token + if: vars.RELEASE_APP_ID != '' + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: ether + repositories: etherpad,ether.github.com - name: Checkout repository uses: actions/checkout@v7 with: repository: ether/etherpad-lite path: etherpad - token: '${{ secrets.ETHER_RELEASE_TOKEN }}' + token: ${{ steps.app-token.outputs.token || secrets.ETHER_RELEASE_TOKEN }} fetch-depth: '0' fetch-tags: 'true' - name: Checkout master @@ -46,7 +60,7 @@ jobs: with: repository: ether/ether.github.com path: ether.github.com - token: '${{ secrets.ETHER_RELEASE_TOKEN }}' + token: ${{ steps.app-token.outputs.token || secrets.ETHER_RELEASE_TOKEN }} - uses: actions/cache@v6 name: Cache pnpm store with: From 21439a811d4c6fc7da815e2f73adb922ea087034 Mon Sep 17 00:00:00 2001 From: John McLear Date: Sun, 18 Oct 2026 13:14:36 +0100 Subject: [PATCH 2/2] ci(release): check out ether/etherpad by its current name ether/etherpad-lite is a rename redirect. Use the canonical name so it matches the repository the app token is scoped to. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y5YroE8t1VhXCVTjJhx2kU --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e005dde3e3c..67165e64c05 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,7 +38,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 with: - repository: ether/etherpad-lite + repository: ether/etherpad path: etherpad token: ${{ steps.app-token.outputs.token || secrets.ETHER_RELEASE_TOKEN }} fetch-depth: '0'