From d4f50bfb065947ff9a655de63771c20e656cdfdc Mon Sep 17 00:00:00 2001 From: Georgiy Tarasov Date: Mon, 31 Aug 2026 14:20:10 -0400 Subject: [PATCH] fix(ci): publish agent skills releases with the job's own token The release steps minted a token from the paths-filter GitHub App, which is a read-only app. Since 2026-08-03 the release API returns 403, so no skills.zip has shipped and the PostHog AI plugin syncs a frozen catalog. The job already declares contents: write, so use github.token, matching build-phrocs.yml and build-livestream-tui.yml. No workflow triggers off these releases, so the app token bought nothing. Generated-By: PostHog Desktop Task-Id: b2be3049-0d16-4222-86f2-404d47c20a02 --- .github/workflows/ci-agent-skills.yml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci-agent-skills.yml b/.github/workflows/ci-agent-skills.yml index a8f3bca333b1..3ffc62645495 100644 --- a/.github/workflows/ci-agent-skills.yml +++ b/.github/workflows/ci-agent-skills.yml @@ -515,13 +515,6 @@ jobs: DEBUG: 1 run: ./bin/hogli build:skills - - name: Mint release GitHub token - id: release-token - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 - with: - client-id: ${{ vars.GH_APP_POSTHOG_PATHS_FILTER_APP_ID }} - private-key: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }} - - name: Determine next version id: version run: | @@ -532,8 +525,11 @@ jobs: echo "tag=agent-skills-v0.$((MINOR + 1)).0" >> "$GITHUB_OUTPUT" - name: Create versioned release + # The job's own contents:write GITHUB_TOKEN, like build-phrocs.yml and + # build-livestream-tui.yml. No workflow triggers off these releases, so the + # app token bought nothing and only added a permission that can drift away. env: - GH_TOKEN: ${{ steps.release-token.outputs.token }} + GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.version.outputs.tag }} run: | gh release create "$RELEASE_TAG" \ @@ -545,7 +541,7 @@ jobs: - name: Update latest release env: - GH_TOKEN: ${{ steps.release-token.outputs.token }} + GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.version.outputs.tag }} run: | if gh release view agent-skills-latest &>/dev/null; then