From 286098450fa2c204a608cdf5d79db6b1d8a2798e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kasper=20Garn=C3=A6s?= Date: Tue, 15 Sep 2026 15:08:44 +0200 Subject: [PATCH] ci: push release commits with the release token actions/checkout persisted the workflow token as the git credential, so semantic-release pushed the release commit with it and the main ruleset rejected the push. The release token was only used for the GitHub API. Check out with the release token instead, so every git push in the job uses it, including the major version tag. Assisted-by: Claude --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b0b1333..52b3b69 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,9 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + # Every git push in this job then uses the release token, which is + # on the bypass list of the main ruleset. The workflow token is not. + token: ${{ secrets.GH_RELEASE_TOKEN }} - name: Setup Node uses: actions/setup-node@v7 @@ -42,7 +45,7 @@ jobs: # commit is pushed straight to main. GITHUB_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }} - - name: Move floating major tag + - name: Point the major version tag at the release if: steps.release.outputs.new_release_published == 'true' env: MAJOR_TAG: v${{ steps.release.outputs.new_release_major_version }}