From e6915498046036d18535dfca9404affe9e0c0124 Mon Sep 17 00:00:00 2001 From: Jose Armesto Date: Thu, 21 May 2026 18:09:18 +0200 Subject: [PATCH 1/4] feat(release): authenticate release-please via GitHub App Replace the TAYLORBOT_GITHUB_ACTION PAT with a token minted by actions/create-github-app-token using RELEASE_PLEASE_APP_ID and RELEASE_PLEASE_PRIVATE_KEY org secrets. App tokens trigger downstream workflows on release PRs and remove the dependency on the taylorbot user account. --- .github/workflows/release.yaml | 15 +++++++++++++-- CHANGELOG.md | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 13a2825..5d4b3e3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,7 +8,11 @@ name: Release on: workflow_call: secrets: - TAYLORBOT_GITHUB_ACTION: + RELEASE_PLEASE_APP_ID: + description: App ID (or Client ID) for create-github-app-token + required: true + RELEASE_PLEASE_PRIVATE_KEY: + description: Private key for create-github-app-token required: true outputs: release_created: @@ -47,10 +51,17 @@ jobs: patch: ${{ steps.release_please.outputs.patch }} pr: ${{ steps.release_please.outputs.pr }} steps: + - name: Generate GitHub App token + id: generate_token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} + - name: Run release-please id: release_please uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: - token: ${{ secrets.TAYLORBOT_GITHUB_ACTION }} + token: ${{ steps.generate_token.outputs.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 4bd2675..ead888d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ Instead this file uses a date-based structure. ### Changed +- `release.yaml` (release-please reusable workflow) now authenticates via a GitHub App instead of a PAT. Callers must pass `RELEASE_PLEASE_APP_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets in place of `TAYLORBOT_GITHUB_ACTION`. Using an App token (minted by `actions/create-github-app-token`) means release PRs trigger downstream workflows — unlike commits made with `GITHUB_TOKEN` or PRs opened by a PAT in some configurations — and removes the dependency on the taylorbot user account. - `create-release-pr` now opens release PRs with a Conventional Commits-compatible title of the form `chore(release): vX.Y.Z` (previously `Release vX.Y.Z`). The release commit message it creates uses the same form. - `create-release` and `update-action-version` accept both the new `chore(release): vX.Y.Z` form and the legacy `Release vX.Y.Z` form, so in-flight release PRs created by older versions of `create-release-pr` continue to be picked up after their merge commit lands. - `validate-changelog.yaml` now validates the H3 sections of the version block against the [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) set: `### Added`, `### Changed`, `### Deprecated`, `### Removed`, `### Fixed`, `### Security`. Unknown H3 sections fail validation. `### Security` is accepted for CVE fixes and vulnerability mitigations. Release CHANGELOGs that do not use `### Security` continue to pass. From 015841cfaa03d5dc57c845310ccec3847d7e3ea8 Mon Sep 17 00:00:00 2001 From: Jose Armesto Date: Mon, 25 May 2026 11:16:21 +0200 Subject: [PATCH 2/4] fix(release): use app-id input to match RELEASE_PLEASE_APP_ID secret The secret stores the numeric App ID, not the Client ID. Switch the create-github-app-token input from client-id to app-id so the value and the parameter match. --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 5d4b3e3..08a6e99 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -9,7 +9,7 @@ on: workflow_call: secrets: RELEASE_PLEASE_APP_ID: - description: App ID (or Client ID) for create-github-app-token + description: App ID for create-github-app-token required: true RELEASE_PLEASE_PRIVATE_KEY: description: Private key for create-github-app-token @@ -55,7 +55,7 @@ jobs: id: generate_token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} + app-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} - name: Run release-please From 2ac256002872d6508bf7af64b16fdf965f0e953e Mon Sep 17 00:00:00 2001 From: Jose Armesto Date: Wed, 27 May 2026 13:45:09 +0200 Subject: [PATCH 3/4] refactor(release): use client-id input on create-github-app-token GitHub now recommends client-id over the deprecated app-id input. Matches the convention used by other workflows in this repo (fix-vulnerabilities.yaml, dispatch-update-chart-*.yaml). The RELEASE_PLEASE_APP_ID org secret must now hold the App's Client ID (e.g. Iv23li...) instead of the numeric App ID. --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 08a6e99..e4e7083 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -9,7 +9,7 @@ on: workflow_call: secrets: RELEASE_PLEASE_APP_ID: - description: App ID for create-github-app-token + description: Client ID for create-github-app-token required: true RELEASE_PLEASE_PRIVATE_KEY: description: Private key for create-github-app-token @@ -55,7 +55,7 @@ jobs: id: generate_token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} + client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} - name: Run release-please From ec7fe925dc14c8a33aadbf4930ab331e003a32e9 Mon Sep 17 00:00:00 2001 From: Jose Armesto Date: Wed, 27 May 2026 13:48:49 +0200 Subject: [PATCH 4/4] refactor(release): rename secret to RELEASE_PLEASE_CLIENT_ID The secret holds the App's Client ID (not the numeric App ID), so the name should reflect that. Pairs cleanly with the client-id: input on create-github-app-token. --- .github/workflows/release.yaml | 4 ++-- CHANGELOG.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e4e7083..d832abd 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,7 +8,7 @@ name: Release on: workflow_call: secrets: - RELEASE_PLEASE_APP_ID: + RELEASE_PLEASE_CLIENT_ID: description: Client ID for create-github-app-token required: true RELEASE_PLEASE_PRIVATE_KEY: @@ -55,7 +55,7 @@ jobs: id: generate_token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }} + client-id: ${{ secrets.RELEASE_PLEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} - name: Run release-please diff --git a/CHANGELOG.md b/CHANGELOG.md index 4873955..3f201fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ Instead this file uses a date-based structure. ### Changed -- `release.yaml` (release-please reusable workflow) now authenticates via a GitHub App instead of a PAT. Callers must pass `RELEASE_PLEASE_APP_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets in place of `TAYLORBOT_GITHUB_ACTION`. Using an App token (minted by `actions/create-github-app-token`) means release PRs trigger downstream workflows — unlike commits made with `GITHUB_TOKEN` or PRs opened by a PAT in some configurations — and removes the dependency on the taylorbot user account. +- `release.yaml` (release-please reusable workflow) now authenticates via a GitHub App instead of a PAT. Callers must pass `RELEASE_PLEASE_CLIENT_ID` and `RELEASE_PLEASE_PRIVATE_KEY` secrets in place of `TAYLORBOT_GITHUB_ACTION`. Using an App token (minted by `actions/create-github-app-token`) means release PRs trigger downstream workflows — unlike commits made with `GITHUB_TOKEN` or PRs opened by a PAT in some configurations — and removes the dependency on the taylorbot user account. - `create-release-pr` now opens release PRs with a Conventional Commits-compatible title of the form `chore(release): vX.Y.Z` (previously `Release vX.Y.Z`). The release commit message it creates uses the same form. - `create-release` and `update-action-version` accept both the new `chore(release): vX.Y.Z` form and the legacy `Release vX.Y.Z` form, so in-flight release PRs created by older versions of `create-release-pr` continue to be picked up after their merge commit lands. - `validate-changelog.yaml` now validates the H3 sections of the version block against the [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) set: `### Added`, `### Changed`, `### Deprecated`, `### Removed`, `### Fixed`, `### Security`. Unknown H3 sections fail validation. `### Security` is accepted for CVE fixes and vulnerability mitigations. Release CHANGELOGs that do not use `### Security` continue to pass.