From a6720f5afe222232ce288f06c63942f92f85a7c2 Mon Sep 17 00:00:00 2001 From: Justin Date: Fri, 30 Oct 2026 12:37:12 -0400 Subject: [PATCH 1/2] ci: stop requesting issues permission for the release token --- .github/workflows/release-please.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6f2e61cd..8c0a5e82 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -37,7 +37,6 @@ jobs: # to tag a release whose commits change .github/workflows/; if the # app lacks it, token creation fails here with that permission named. permission-contents: write - permission-issues: write permission-pull-requests: write permission-workflows: write From 090d6f890900a6b10294dff3641c195112988cc1 Mon Sep 17 00:00:00 2001 From: Justin Date: Fri, 30 Oct 2026 13:03:31 -0400 Subject: [PATCH 2/2] ci: create releases with the built-in token instead of the release app --- .github/workflows/release-please.yml | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 8c0a5e82..d38379cf 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -27,24 +27,15 @@ jobs: tag_name: ${{ steps.release.outputs.tag_name }} steps: - - name: Generate GitHub App Token - id: app-token - uses: actions/create-github-app-token@v2 - with: - app-id: ${{ secrets.RELEASE_APP_ID }} - private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - # Listing permissions limits the token to these. workflows is needed - # to tag a release whose commits change .github/workflows/; if the - # app lacks it, token creation fails here with that permission named. - permission-contents: write - permission-pull-requests: write - permission-workflows: write - - name: Run Release Please uses: google-github-actions/release-please-action@v4 id: release with: - token: ${{ steps.app-token.outputs.token }} + # The built-in token, as runpod-python uses. The release app lacks the + # workflows permission #399 requested, so its token can't be created. + # The workflow-level permissions grant contents, pull-requests and + # issues write. + token: ${{ secrets.GITHUB_TOKEN }} pypi-publish: name: PyPI Publish