ci: use a GitHub App token to authenticate releases#6
Merged
Conversation
jamesnrokt
reviewed
Jun 15, 2026
…e plugin Replace @semantic-release/github with explicit GitHub Release creation. The release steps (resolve version, extract notes, create release) are appended to the existing sync-repository job so they reuse its App token and main checkout rather than duplicating them in a separate job. semantic-release still owns version determination, CHANGELOG, npm publish, and tagging; only the Release creation moves out into a SHA-pinned action. Because it runs after the branch sync, a Release-creation failure can no longer fail the release job or block npm publish, the tag, or the sync. Version is read from the bumped package.json; notes are extracted from CHANGELOG.md and the dist bundles are attached. Pattern adapted from the RoktUXHelper iOS "Release - Publish" workflow (ffurrer2/extract-release-notes + ncipollo/release-action).
Drop the ffurrer2/extract-release-notes step and let ncipollo generate the release notes via generateReleaseNotes. Simpler, and avoids the CHANGELOG format mismatch between semantic-release and the Keep-a-Changelog parser.
jamesnrokt
approved these changes
Jun 18, 2026
jamesnrokt
left a comment
jamesnrokt
left a comment
There was a problem hiding this comment.
Approved and verified the referenced secrets are setup
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches the release pipeline from authenticating with a long-lived classic PAT
(
MP_INTEGRATIONS_SEMANTIC_RELEASE_BOT) to a short-lived GitHub App installationtoken, matching the approach used in the
rokt-sdk-iosrelease workflow.The most recent release run published
1.1.0to npm successfully but failed atthe final
@semantic-release/githubstep with a404on the GitHub Releases API(
POST /repos/mparticle-integrations/.../releases). The PAT had the correctreposcope but its underlying account lacks access to create releases in thisrepo, so the GitHub Release was never created and the branch-sync step was
skipped.
Changes (in
.github/workflows/release.yml):Generate GitHub App tokenstep (actions/create-github-app-token) tothe
releaseandsync-repositoryjobs, using theSDK_RELEASE_GITHUB_APP_ID/SDK_RELEASE_GITHUB_APP_PRIVATE_KEYsecrets.actions/checkoutand asGITHUB_TOKENfor semantic-release(which creates the GitHub Release and pushes the tag/release commit).
sync-repositorycheckout that pushes tomain/developmentand deletes the release branch.
MP_INTEGRATIONS_SEMANTIC_RELEASE_BOT.create-release-branchis left on the defaultGITHUB_TOKENsince it only pushesa new
release/*branch, which the built-in token is already allowed to do.Testing Plan
This is a CI/CD-only change and can't be exercised by unit tests or a PR check,
it only runs in the
Release Kitworkflow onworkflow_dispatch.Validation will happen on the next release run:
Generate GitHub App tokenstep succeeds in both jobs.@semantic-release/githubcreates thevX.Y.ZGitHub Release (no 404).sync-repositoryupdatesmain/developmentand deletes the release branch.A
dryRun = truerun can sanity-check token generation and version computation,but it won't exercise the actual GitHub Release creation.