fix(ci): stop persisted token overriding app token on auto-tag push#500
Conversation
…push auto-tag-release.yml mints a release-bot app token and pushes the v<version> tag with an x-access-token URL, but actions/checkout had persisted an http.extraheader Authorization for github-actions[bot]. That extraheader overrides the URL-embedded credential on git push, so the push authenticated as github-actions[bot] — which cannot push tags — and failed with 'remote: Permission to UseJunior/safe-docx.git denied to github-actions[bot]'. Every version-bump merge stranded its tag (v0.11.0 and v0.11.1 both had to be tagged manually). Set persist-credentials: false so no extraheader is written and the explicit app-token URL in the push step is used. The detect step only does local git reads plus an unauthenticated 'git ls-remote --tags' on a public repo, so dropping the persisted credential is safe.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
LLM-Based Quality GateOverall: ✅ PASS (3 pass · 0 warn · 12 skipped · 15 total)
Full checklist questions
Estimated cost (this run): $0.0023 — 6,612 input + 119 output tokens (≈4 chars/token) on |
LLM-Based Quality GateOverall: ✅ PASS (3 pass · 0 warn · 12 skipped · 15 total)
Full checklist questions
Estimated cost (this run): $0.0024 — 6,612 input + 147 output tokens (≈4 chars/token) on |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
✅ Post-merge smoke passedMerged: Steps
Note: the This workflow only truly exercises on the next release-bump merge — that's the real-world confirmation to watch. v0.11.2 is already published on npm ( Cleanup
Log: |
1 participant
Problem
auto-tag-release.ymlis supposed to push thev<version>tag (which triggersrelease.ymlto publish) when achore(release): bump workspace versionsPR merges to main. It has failed on every release —v0.11.0andv0.11.1both had to be tagged manually — with:Root cause
It is not the release-bot app or its key — the token mints fine (
APP_TOKEN: ***is non-empty in the failing log, and the same app token works inrelease.yml's changelog job). The bug:actions/checkoutpersists anhttp.https://github.com/.extraheaderAuthorization header forgithub-actions[bot].git push https://x-access-token:${APP_TOKEN}@github.com/....extraheaderoverrides the URL-embedded credential, so the push authenticates asgithub-actions[bot]— which can't push tags — instead of the release-bot app.Fix
persist-credentials: falseon the checkout, so noextraheaderis written and the explicitx-access-tokenURL in the push step is the credential used.Safe because this job's only other git work is local reads (
git show,git cat-file) plus an unauthenticatedgit ls-remote --tags originon this public repo — none need the persisted credential.After this merges
The next version-bump merge should auto-push its tag with no manual intervention. (This PR itself is not a version bump, so it won't trigger a release.)