Skip to content

Scope the remaining release app tokens and bind a trailer #6272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChrisJBurns merged 2 commits into from
Aug 10, 2026
Merged

Scope the remaining release app tokens and bind a trailer #6272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
48e9ccf
Scope the release tag token and bind the commit trailer
ChrisJBurns Aug 10, 2026
6814493
Scope the Homebrew tap token to contents
ChrisJBurns Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/create-release-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ jobs:
with:
client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
# Without this the token carries every permission the app
# installation holds. It is used to push the tag and to create the
# GitHub Release, both of which are contents.
permission-contents: write

- name: Checkout
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
Expand Down Expand Up @@ -161,7 +165,6 @@ jobs:
if: steps.check-release.outputs.exists == 'false'
run: |
TAG="v${{ steps.version.outputs.version }}"
TRIGGERED_BY="${{ steps.actor.outputs.triggered_by }}"

# Create GitHub Release (triggers releaser.yml via release event)
# Note: Uses a GitHub App installation token rather than GITHUB_TOKEN,
Expand All @@ -180,6 +183,10 @@ jobs:
echo "Created GitHub Release: $TAG"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
# Read out of a git commit trailer, so unlike the version — which is
# checked against a semver pattern before use — this one is not
# constrained by anything. Bound rather than interpolated.
TRIGGERED_BY: ${{ steps.actor.outputs.triggered_by }}

- name: Summary
run: |
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/releaser.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,11 @@ jobs:
private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
owner: stacklok
repositories: homebrew-tap
# Already limited to one repository by the two lines above; this
# limits it to one permission as well. GoReleaser commits the formula
# straight to the tap's default branch — the brews block configures no
# pull request — so contents is all it uses.
permission-contents: write

- name: Run GoReleaser
id: run-goreleaser
Expand Down
Loading