Conversation
The release should now be attribute to the GitHub App that's used, rather than github-actions. But for real this time.
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_TOKEN: ${{ steps.releaser.outputs.token }} |
There was a problem hiding this comment.
Of course attribution wasn't working, we were passing the wrong token.
There was a problem hiding this comment.
@rafaeelaudibert sanity check: was there an explicit reason this uses the default GITHUB_TOKEN?
There was a problem hiding this comment.
I believe 2-fold:
GITHUB_TOKENhad enough permission to do it- I don't think the releaser bots have access to create releases. We always give it "contents: write" permission only, don't know whether that's enough to create a release
There was a problem hiding this comment.
Creating a release only requires contents: write, so it should be sufficient.
GITHUB_TOKENhad enough permission to do it
I support that 👍 . I suppose the GitHub App is really only needed to be able to push directly to master while bypassing required checks. As of this PR, we also use the App's token to create the release, which isn't strictly necessary. There may be some limited value in the version bump commit and the release being attributed to the same user, but that feels really minor.
|
Last reviewed commit: 63fd980 |
| permissions: | ||
| contents: write | ||
| actions: write | ||
| id-token: write |
There was a problem hiding this comment.
I audited whether we could remove contents and actions perms, but it looks like the "Dispatch generate-references" step may still need them.
posthog-python Compliance ReportDate: 2026-03-10 21:44:12 UTC ✅ All Tests Passed!29/29 tests passed Capture Tests✅ 29/29 tests passed View Details
|
rafaeelaudibert
left a comment
rafaeelaudibert
left a comment
There was a problem hiding this comment.
I'm not positive the bot has permission to publish a release! You might wanna check that.
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_TOKEN: ${{ steps.releaser.outputs.token }} |
There was a problem hiding this comment.
I believe 2-fold:
GITHUB_TOKENhad enough permission to do it- I don't think the releaser bots have access to create releases. We always give it "contents: write" permission only, don't know whether that's enough to create a release
2 participants
The release should now be attributed to the GitHub App that's used, rather than github-actions. But for real this time.