Skip to content

fix: re-mint GitHub App token before goreleaser to avoid mid-run expiry #281

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Andriy Knysh (aknysh) merged 1 commit into from
Sep 4, 2026
Merged

fix: re-mint GitHub App token before goreleaser to avoid mid-run expiry #281

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions .github/workflows/shared-go-auto-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,26 @@ jobs:
df -h


# Re-minted immediately before the long-running goreleaser invocation:
# GitHub App installation tokens are hard-capped at 1 hour (not
# configurable), and the goreleaser step below (build + sign + SBOM +
# publish, across every platform target) has been taking 45-65+
# minutes on its own and trending upward. The original `github-app`
# token from the top of this job has already burned several minutes on
# setup (git/gpg install, harden-runner init, syft install, checkout,
# unshallow, go setup, gpg import, disk-space checks, apt cleanup)
# before goreleaser even starts, so by the time goreleaser reaches its
# final publish-phase API calls (listing/deleting existing drafts) the
# original token can already be expired, failing with a `401 Bad
# credentials` that has nothing to do with the release content itself.
# Minting a fresh token right here maximizes the runway goreleaser gets
# before its own token goes stale.
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: github-app-release
with:
app-id: ${{ vars.BOT_GITHUB_APP_ID }}
private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}

- name: Run GoReleaser
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
id: releaser
Expand All @@ -252,7 +272,7 @@ jobs:
args: release --config ${{ steps.go-releaser-config.outputs.path }} --clean --timeout 180m
env:
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
GITHUB_TOKEN: ${{ steps.github-app.outputs.token }}
GITHUB_TOKEN: ${{ steps.github-app-release.outputs.token }}
GO_RELEASER_TARGET_COMMITISH: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
GO_RELEASER_DRAFT_MODE: ${{ inputs.draft }}

Expand All @@ -264,7 +284,7 @@ jobs:
- name: "Attest build provenance"
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
with:
github-token: ${{ steps.github-app.outputs.token }}
github-token: ${{ steps.github-app-release.outputs.token }}
subject-path: 'source/dist/*'

- name: "Resolve checksums file"
Expand Down
Loading