From 24f21af8350227e77fc1fef9243c238e6417aca0 Mon Sep 17 00:00:00 2001 From: Logan Date: Fri, 13 Feb 2026 21:46:19 -0600 Subject: [PATCH] fix(ci): configure git credentials explicitly for semantic-release PAT persist-credentials: false prevents actions/checkout from overriding git auth with GITHUB_TOKEN. Manual credential store setup ensures all git pushes (including from @semantic-release/git) use the PAT, which is required to trigger the build workflow on tag push. --- .github/workflows/release.yml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 81fe251..5db1b7b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,12 +20,20 @@ jobs: name: Semantic Release runs-on: ubuntu-latest steps: - # Use a PAT so that the tag push triggers the build workflow. - # GITHUB_TOKEN events don't trigger other workflows (by design). + # persist-credentials: false prevents actions/checkout from setting up + # the credential helper with GITHUB_TOKEN. We configure git auth manually + # with the PAT so that tag pushes trigger downstream workflows. - uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.RELEASE_TOKEN }} + persist-credentials: false + + - name: Configure git credentials + run: | + git config --global credential.helper store + echo "https://x-access-token:${{ secrets.RELEASE_TOKEN }}@github.com" > ~/.git-credentials + git config --global user.name "github-actions[bot]" + git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" - uses: actions/setup-node@v4 with: @@ -45,4 +53,8 @@ jobs: - name: Run semantic-release env: GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }} + GIT_AUTHOR_NAME: github-actions[bot] + GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com + GIT_COMMITTER_NAME: github-actions[bot] + GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com run: npx semantic-release