From b8fae960d446f356d694810e2580d8be3ceddeba Mon Sep 17 00:00:00 2001 From: Nate Moore Date: Tue, 1 Sep 2026 17:36:13 -0400 Subject: [PATCH 1/3] fix(ci): run changeset release as bombshell-bot app The Publish workflow passed the default `secrets.GITHUB_TOKEN` to `changesets/action`, so the "Version Packages" PR, the version-bump commit, and the release tag were all attributed to `github-actions[bot]` instead of our `bombshell-bot` GitHub App like the other Bombshell repos. Mint an installation token from the org-level `BOT_APP_ID` / `BOT_PRIVATE_KEY` secrets via `actions/create-github-app-token`, check out with it so the persisted git credentials push as the app, set the git user to the app identity so the bump commit is authored by it, and hand the token to `changesets/action` so it opens the PR as the app. tty can't reuse `bombshell-dev/automation`'s publish workflow (that one builds with pnpm/Node; tty builds WASM via make + Deno), so the app-token pattern is inlined here. `push-with-git-cli: true` stays because the clay submodule gitlink breaks the GitHub-API push path (0e10dcd), which is also why the git-user config is needed for commit authorship. --- .github/workflows/publish.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 113b86c..b3c11de 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,11 +19,25 @@ jobs: pull-requests: write # open the "Version Packages" PR id-token: write # npm publish via OIDC trusted publishing steps: + - name: generate bot token + id: bot-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.BOT_APP_ID }} + private-key: ${{ secrets.BOT_PRIVATE_KEY }} + - name: checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true fetch-depth: 0 + persist-credentials: true + token: ${{ steps.bot-token.outputs.token }} + + - name: setup git user + run: | + git config --global user.name "bombshell-bot[bot]" + git config --global user.email "187071675+bombshell-bot[bot]@users.noreply.github.com" - name: setup deno uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 @@ -55,4 +69,4 @@ jobs: create-github-releases: false push-with-git-cli: true env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.bot-token.outputs.token }} From feaa3ddda63bf77c3ae4ed958073cf190c968012 Mon Sep 17 00:00:00 2001 From: Nate Moore Date: Fri, 4 Sep 2026 16:47:32 -0400 Subject: [PATCH 2/3] Apply suggestion from @natemoo-re --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b3c11de..8a56cb0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -69,4 +69,4 @@ jobs: create-github-releases: false push-with-git-cli: true env: - GITHUB_TOKEN: ${{ steps.bot-token.outputs.token }} + github-token: ${{ steps.bot-token.outputs.token }} From df5a2b99f9f37d8315238bd229c80641d29d809e Mon Sep 17 00:00:00 2001 From: Nate Moore Date: Fri, 4 Sep 2026 16:47:49 -0400 Subject: [PATCH 3/3] Apply suggestion from @natemoo-re --- .github/workflows/publish.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8a56cb0..073ea97 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -68,5 +68,4 @@ jobs: pr-title: "chore: version packages" create-github-releases: false push-with-git-cli: true - env: github-token: ${{ steps.bot-token.outputs.token }}