Repository navigation
ci(release): open the release pull request with a least-privilege App token - #921
Merged
Merged
Conversation
… token release-please.yml mints a short-lived installation token with actions/create-github-app-token (SHA-pinned) from RELEASE_APP_CLIENT_ID and RELEASE_APP_PRIVATE_KEY, scoped to contents and pull requests write, and gives it to release-please and the branch checkout so the pull request starts CI. Without both secrets the job warns and falls back to GITHUB_TOKEN; with only one it fails. Tests hold the pin, the two permissions, the two uses and the fallback. docs/compatibility.md 5.1 and RELEASE_POLICY.md list the permissions and the owner's setup steps. Refs #895 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
yeongseon
added
epic:governance
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
무엇
2026-10-12 소유자 결정(#895): release-please 가 연 release PR 의 필수 체크는 최소 권한 GitHub App 토큰으로 돌린다. 이 PR 은 kpubdata 워크플로 쪽 준비다.
.github/workflows/release-please.ymlactions/create-github-app-token@bcd2ba49…(v3.2.0, 커밋 SHA 고정)으로 secretRELEASE_APP_CLIENT_ID·RELEASE_APP_PRIVATE_KEY에서 설치 토큰을 받는다. 토큰은permission-contents: write,permission-pull-requests: write두 가지로만 발급한다.No release App token)를 남기고 지금처럼GITHUB_TOKEN으로 돈다 — 오늘 릴리스가 멈추지 않는다. 하나만 있으면 설정이 깨진 것이므로 잡이 실패한다.RELEASE_PLEASE_TOKEN경로(저장소에 secret 없음)는 지웠다.tests/unit/scripts/test_release_please.py): SHA 고정, 권한이 정확히 두 가지, 토큰 사용처가 release-please·체크아웃 두 곳뿐(GH_TOKEN없음), secret 없을 때 경고·하나만 있을 때 실패.tests/unit/test_no_workflow_merges.py는 그대로 통과 — 어떤 워크플로도 병합·승인하지 않는다.docs/compatibility.md5.1 에 secret 이름, App 권한 표, 소유자 설정 단계(App 생성 → 세 저장소에 설치 → secret 추가 → 수동 실행으로 확인).docs/governance/RELEASE_POLICY.md에 요약. Studio 가 Builder 버전 태그를 계속 따른다는 결정(ADR 0004)도 5.1 에 적었다.CHANGELOG.md: feat(specs): declare per-dataset application requirement in specs #902 항목의 "left open" 을 결정(스키마에application필드 없음, 17개null은 chore(metadata): confirm the application requirement for the 17 spec datasets recorded as null #920)으로 고쳤다.릴리스·태그 없음. #890 은 건드리지 않았다. Builder·Studio 의 release-please 이전은 별도 작업이다.
확인
ruff check .→ All checks passed! /ruff format --check .→ 433 files already formatted /mypy src→ no issues in 70 source filescheck_english_comments.py→ no Korean comments /check_plain_codes.py→ no bare codemkdocs build --strict→ builtpytest→ 3407 passed, 2 failed — 실패 2개(test_build_dataset_verifier.py의 approval 두 개)는 이 변경 없이main에서도 로컬에서 같은 실패(환경 차이로 보임). CI 결과로 확인한다.Refs #895
🤖 Generated with Claude Code