From 9377fe0a668594458cecba03b06e8e5f4508dc3e Mon Sep 17 00:00:00 2001 From: Daniel Elskamp Date: Fri, 12 Jun 2026 05:46:08 +0200 Subject: [PATCH] ci(release): push CHANGELOG to develop via RELEASE_TOKEN PAT The protect-develop ruleset blocks direct pushes to develop, and the GitHub Actions bot can't be added as a bypass actor on a user-owned repo. Pushing with an admin-owned fine-grained PAT (Contents: read/write) attributes the push to the admin, who is already a bypass actor in the ruleset. Requires a RELEASE_TOKEN repo secret. --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6302f65..af2465c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,6 +24,12 @@ jobs: fetch-depth: 0 # Check out the branch (not the detached tag) so we can commit CHANGELOG.md back. ref: develop + # Push back to develop with a PAT, not the default GITHUB_TOKEN: the + # `protect-develop` ruleset blocks direct pushes, and the GitHub Actions + # bot cannot be a bypass actor on a user-owned repo. A PAT owned by an + # admin is attributed to that admin, whom the ruleset's admin bypass + # already covers. RELEASE_TOKEN: fine-grained PAT, Contents: read/write. + token: ${{ secrets.RELEASE_TOKEN }} - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: