ci: push release commits via deploy key instead of GITHUB_TOKEN - #463
Merged
Conversation
python-semantic-release ignores the checkout's SSH remote and pushes to an HTTPS URL authenticated with GH_TOKEN, so the release commit push to main is rejected by the branch ruleset (the github-actions integration has no bypass; the deploy key does). Set remote.ignore_token_for_push so PSR pushes via origin (SSH + DEPLOY_KEY), which is on the ruleset bypass list. GH_TOKEN is still used to create the GitHub release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second (and final) release-pipeline bug, exposed by #462 getting further than any previous run:
semantic-release got all the way to pushing the
chore(release): 0.1.0commit, but the push was rejected by the main ruleset (GH013) even with Deploy keys on the bypass list. The failing command reveals why:PSR doesn't push via the checkout's SSH remote — it constructs its own HTTPS token URL from
GH_TOKEN, so the pushing actor is thegithub-actionsintegration, which has no bypass. TheDEPLOY_KEYnever gets used for the push.Fix:
remote.ignore_token_for_push = true— PSR's documented option for exactly this ("ideal if you already have SSH keys set up for pushing"). The push then goes throughorigin(git@github.com:sjawhar/pivot.git+core.sshCommandwith the deploy key, verified in the run 29273503528 logs), which is on the ruleset bypass list.GH_TOKENis still used for creating the GitHub release.After merge: Tests → Release → tag
v0.1.0→ publish pivot + pivot-tui to PyPI via trusted publishing.