ci(release): open Release PR with org App token, not GITHUB_TOKEN#23
Open
ALLiDoizCode wants to merge 1 commit into
Open
ci(release): open Release PR with org App token, not GITHUB_TOKEN#23ALLiDoizCode wants to merge 1 commit into
ALLiDoizCode wants to merge 1 commit into
Conversation
The org disables "Allow GitHub Actions to create and approve pull requests", so changesets/action cannot open the Version Packages PR with the default GITHUB_TOKEN (it fails with "GitHub Actions is not permitted to create or approve pull requests"). The policy is org-level and cannot be overridden per-repo; pull-requests: write is not sufficient. Mirror the org's decomposer/executor loops: mint the org App token (APP_ID/APP_PRIVATE_KEY) and pass it to changesets/action as GITHUB_TOKEN. An App is a distinct actor, so its PRs are exempt. continue-on-error keeps a GITHUB_TOKEN fallback for the publish path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Releaseworkflow useschangesets/action, which opens a "Version Packages" PR with the defaultGITHUB_TOKEN. The org has "Allow GitHub Actions to create and approve pull requests" disabled, so this fails with:The policy is enforced org-wide and cannot be overridden per-repo; the workflow's
pull-requests: writegrant is not sufficient. This already broketoon's release (toon-protocol/toon#27); this repo has the identical workflow and will fail the same way on its next pending changeset.Fix
Mint the org GitHub App token (
APP_ID/APP_PRIVATE_KEY) and pass it tochangesets/actionasGITHUB_TOKEN— the same pattern the org's decomposer/executor loops use. A GitHub App is a distinct actor, so its PRs are not subject to the Actions PR-creation policy.continue-on-error: trueon the token step preserves aGITHUB_TOKENfallback so the publish path still works if the App is ever uninstalled.No org-admin change required.
🤖 Generated with Claude Code