From 931019c082cb595d1ca6127ac6edc94da104d800 Mon Sep 17 00:00:00 2001 From: Jiri Spilka Date: Fri, 31 Jul 2026 12:23:53 +0200 Subject: [PATCH] ci: release with the service account token The org ruleset "Run Apify Pull Request Toolkit on every PR" requires that workflow on main, and github-actions is not a bypass actor, so the release job's push to main was rejected. The Service Account team does bypass the ruleset, so use its token for the checkout push and for gh, as other apify repos do. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b2f510e..eacf3c0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,9 +28,13 @@ jobs: - uses: actions/checkout@v4 with: ref: main + # An org ruleset requires the Apify pull request toolkit workflow on main, so a push + # authenticated as github-actions is rejected. The service account is a ruleset bypass + # actor; every apify repo releases through this token. + token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} - name: Bump version, tag, and release env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} run: | MANIFEST=.claude/.claude-plugin/plugin.json CURRENT=$(jq -er '.version' "$MANIFEST") @@ -43,6 +47,6 @@ jobs: jq --arg v "$VERSION" '.version = $v' "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST" git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - git commit -am "chore: release v$VERSION" + git commit -am "chore: release v$VERSION [skip ci]" git push origin main gh release create "v$VERSION" --target main --generate-notes