From aa1b2bd9f07082a24f0422db797e73b31886f351 Mon Sep 17 00:00:00 2001 From: John McLear Date: Mon, 19 Oct 2026 11:38:50 +0100 Subject: [PATCH] ci(release): drop expired ETHER_RELEASE_TOKEN fallback The release workflow now always mints its token from the etherpad-release-bot GitHub App. The PAT secret has been deleted, so the fallback evaluated to an empty string. Making the app step unconditional means a missing app config fails loudly instead of checking out with no token. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y5YroE8t1VhXCVTjJhx2kU --- .github/workflows/release.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67165e64c05..de8c1000e83 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,14 +21,12 @@ jobs: releases: runs-on: ubuntu-latest steps: - # Prefer a short-lived token from the "Etherpad Release Bot" GitHub App: - # app credentials don't expire, unlike the ETHER_RELEASE_TOKEN PAT. Until - # the RELEASE_APP_ID variable is set this step is skipped and the PAT is - # used. The built-in GITHUB_TOKEN won't do: tags pushed with it don't - # trigger the Docker, .deb, snap and GitHub Release workflows. + # Short-lived token from the "etherpad-release-bot" GitHub App; app + # credentials don't expire like a PAT does. The built-in GITHUB_TOKEN + # won't do: tags pushed with it don't trigger the Docker, .deb, snap and + # GitHub Release workflows. - name: Get release token from GitHub App id: app-token - if: vars.RELEASE_APP_ID != '' uses: actions/create-github-app-token@v2 with: app-id: ${{ vars.RELEASE_APP_ID }} @@ -40,7 +38,7 @@ jobs: with: repository: ether/etherpad path: etherpad - token: ${{ steps.app-token.outputs.token || secrets.ETHER_RELEASE_TOKEN }} + token: ${{ steps.app-token.outputs.token }} fetch-depth: '0' fetch-tags: 'true' - name: Checkout master @@ -60,7 +58,7 @@ jobs: with: repository: ether/ether.github.com path: ether.github.com - token: ${{ steps.app-token.outputs.token || secrets.ETHER_RELEASE_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - uses: actions/cache@v6 name: Cache pnpm store with: