Skip to content

ci(publish): use GitHub App token for release commit-back #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gmasci-ca merged 2 commits into from
Jul 10, 2026
Merged

ci(publish): use GitHub App token for release commit-back #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b4b0a3d
ci(publish): use GitHub App token for commit-back to bypass branch pr…
gmasci-ca Jul 10, 2026
e7c8f53
ci: serialize build (-m:1) to fix intermittent CS0006 race
gmasci-ca Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,10 @@ jobs:
run: dotnet restore CodeArchitects.Platform.sln

- name: Build
run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore
# -m:1 (single MSBuild node) serializes the build so multi-targeted
# ProjectReferences build in dependency order, avoiding an intermittent
# CS0006 "metadata file could not be found" race under parallel builds.
run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1

- name: Test (unit & functional)
shell: bash
Expand Down
20 changes: 17 additions & 3 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,11 @@ name: Publish packages
# (or `v7.1.0-rc.1`) publishes exactly that version.
#
# Requires repository secret NUGET_API_KEY (a NuGet.org API key with push rights
# for the CodeArchitects.Platform.* package ids). Commit-back uses GITHUB_TOKEN.
# for the CodeArchitects.Platform.* package ids). The commit-back + tag push is
# authenticated with a GitHub App installation token (secrets
# CODEARCHITECTS_RELEASE_BOT_APP_ID / CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY) so it
# can bypass the branch ruleset that would otherwise require a pull request. The
# built-in GITHUB_TOKEN cannot bypass that rule.

on:
release:
Expand Down Expand Up @@ -69,10 +73,18 @@ jobs:
permissions:
contents: write # needed to commit the version bump and push the tag
steps:
- name: Generate GitHub App token
id: app_token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
# full history + GitHub App token to bypass branch protection rules
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}
token: ${{ steps.app_token.outputs.token }}

- name: Setup .NET
uses: actions/setup-dotnet@v4
Expand Down Expand Up @@ -106,7 +118,9 @@ jobs:
run: dotnet restore CodeArchitects.Platform.sln

- name: Build
run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -p:Version=${{ steps.meta.outputs.version }}
# -m:1 serializes the build to avoid an intermittent CS0006 race between
# multi-targeted ProjectReferences (see ci.yml for details).
run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1 -p:Version=${{ steps.meta.outputs.version }}

- name: Pack (all packable projects under src/)
shell: bash
Expand Down
Loading