Skip to content

add gh app, use verified-bot-commit #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
andrew-fleming wants to merge 4 commits into
base: main
Choose a base branch
from
Open

add gh app, use verified-bot-commit #60

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
67878bb
add gh app, use verified-bot-commit
andrew-fleming Jan 23, 2026
b55cc07
add comments
andrew-fleming Jan 25, 2026
e4784fe
Apply suggestions from code review
andrew-fleming Jan 29, 2026
0ead0bc
Merge branch 'main' into add-gh-app-token
andrew-fleming Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,24 @@ jobs:
release:
name: Release ${{ inputs.package }}
runs-on: ubuntu-24.04
environment: compact-npm-prod # Requires approval
environment: compact-npm-prod # Includes npm token and requires approval

permissions:
contents: write # Required to push commits and tags

steps:
- name: Get github app token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
id: gh-app-token
with:
app-id: ${{ vars.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- name: Check out code
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 0
token: ${{ steps.gh-app-token.outputs.token }}

- name: Set package directory
id: pkg
Expand Down Expand Up @@ -72,12 +80,20 @@ jobs:
cd packages/${{ steps.pkg.outputs.dir }}
yarn pack --dry-run

- name: Commit and tag version bump
uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
# Uses GitHub API to create signed commits for verification on protected branches
- name: Commit version bump
uses: iarekylew00t/verified-bot-commit@d7e8eea1f154881e1f9d70a3fd933e740148b7f4 # v2.1.1
with:
commit_message: "chore: release ${{ inputs.package }} v${{ steps.version.outputs.new }}"
file_pattern: "packages/${{ steps.pkg.outputs.dir }}/package.json"
tagging_message: "${{ inputs.package }}/v${{ steps.version.outputs.new }}"
message: "Release ${{ inputs.package }} v${{ steps.version.outputs.new }}"
token: ${{ steps.gh-app-token.outputs.token }}
ref: ${{ github.ref_name }}
files: |
packages/${{ steps.pkg.outputs.dir }}/package.json

- name: Create and push tag
run: |
git tag "${{ inputs.package }}/v${{ steps.version.outputs.new }}"
git push origin "${{ inputs.package }}/v${{ steps.version.outputs.new }}"

- name: Publish to npm
run: |
Expand Down