From e1c0a702dd68654a171dc19ab04af14e0e433d1f Mon Sep 17 00:00:00 2001 From: darken Date: Fri, 1 May 2026 09:07:40 +0200 Subject: [PATCH] chore(ci): Rename stale step name and use client-id for App auth --- .claude/rules/release.md | 2 +- .github/workflows/release-prepare.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.claude/rules/release.md b/.claude/rules/release.md index e91f32f5..e8b08295 100644 --- a/.claude/rules/release.md +++ b/.claude/rules/release.md @@ -60,7 +60,7 @@ bats tools/release/bump.bats Required org secrets (set on the d4rken-org organization, accessible to `capod`): -- `RELEASE_APP_ID` — numeric ID of the `d4rken-org-releaser` GitHub App +- `RELEASE_APP_CLIENT_ID` — Client ID of the `d4rken-org-releaser` GitHub App (visible on the App's settings page, format `Iv1.` or similar) - `RELEASE_APP_PRIVATE_KEY` — full `.pem` contents (including BEGIN/END lines) The App is installed on this repo and added as a bypass actor to: diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index 54dfe3f0..f5c0c0cd 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -142,7 +142,7 @@ jobs: id: app-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1 with: - app-id: ${{ secrets.RELEASE_APP_ID }} + client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - name: Resolve bot identity @@ -164,12 +164,12 @@ jobs: persist-credentials: true token: ${{ steps.app-token.outputs.token }} - - name: Re-validate after approval wait + - name: Verify state still matches plan from Job 1 run: | set -euo pipefail ./tools/release/bump.sh --mode=check --expected-current="${CURRENT_NAME_AT_PLAN}" - - name: Re-check tag collision (state may have moved during approval) + - name: Re-check tag collision (state may have moved between jobs) run: | set -euo pipefail if git rev-parse --verify "refs/tags/v${NEW_NAME}" >/dev/null 2>&1; then