Skip to content

fix(ci): pass app token to Publish draft release step - #2532

Merged
myasnikovdaniil merged 1 commit into
mainfrom
fix/ci-publish-draft-token
Apr 30, 2026
Merged

fix(ci): pass app token to Publish draft release step#2532
myasnikovdaniil merged 1 commit into
mainfrom
fix/ci-publish-draft-token

Conversation

@myasnikovdaniil

@myasnikovdaniil myasnikovdaniil commented Apr 29, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What this PR does

Adds an explicit github-token: ${{ steps.app-token.outputs.token }} to the Publish draft release step in .github/workflows/pull-requests-release.yaml.

Without this, the step uses the workflow's default GITHUB_TOKEN, which does not return draft releases via listReleases. As a result the script throws Draft release for vX.Y.Z not found on every release-X.Y.Z PR merge — see e.g. the recent v1.3.1 finalize run https://github.com/cozystack/cozystack/actions/runs/25102689625, plus identical failures on v1.3.0, v1.0.0-beta.5, v1.0.0-alpha.2, v0.39.4, v0.32.x, v0.31.x. Maintainers have been undrafting each release manually.

This bug was fixed once before in 4db55ac ([ci] Add Github token to fetch draft releases) by setting github-token: ${{ secrets.GH_PAT }} on the listing step. It was lost in the refactor in 66a756b (fix(ci): ensure correct latest release after backport publishing), which collapsed the separate Find draft release / Calculate publish flags / Publish draft release steps into one combined step without carrying the github-token over. The April 2026 App-token migration in f96b2da only updated steps that already had a github-token: field, so the publish step was left with the default token.

Release note

fix(ci): release finalization now uses the cozystack-ci App token to publish drafts, fixing "Draft release not found" errors on every release tag.

Summary by CodeRabbit

  • Chores
    • Updated internal CI/CD workflow authentication mechanism to enhance security protocols.

@myasnikovdaniil
fix(ci): pass app token to Publish draft release step
7d2fe2f 
The Publish draft release step used the workflow's default GITHUB_TOKEN,
which does not return draft releases from listReleases — so the script
failed with "Draft release for vX.Y.Z not found" and every release tag
had to be undrafted manually.

This same bug was fixed once before in 4db55ac ([ci] Add Github
token to fetch draft releases) by adding github-token: GH_PAT to the
listing step. It was lost during the refactor in 66a756b that combined
the separate listing/flags/publish steps into a single Publish step,
and not restored when f96b2da migrated remaining github-token usages
from GH_PAT to the cozystack-ci App token.

Add github-token: app-token.outputs.token to the merged step so it
shares the same auth as the rest of the workflow.

Assisted-By: Claude <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>
@gemini-code-assist

gemini-code-assist Bot commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

@dosubot dosubot Bot added the size/XS This PR changes 0-9 lines, ignoring generated files label Apr 29, 2026
@github-actions github-actions Bot added area/ci Issues or PRs related to CI workflows, GitHub Actions, automation kind/bug Categorizes issue or PR as related to a bug labels Apr 29, 2026
@coderabbitai

coderabbitai Bot commented Apr 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5fea1c46-1c13-4b98-af6b-b1e19a5f7397

📥 Commits

Reviewing files that changed from the base of the PR and between 6e045e6 and 7d2fe2f.

📒 Files selected for processing (1)
  • .github/workflows/pull-requests-release.yaml
📝 Walkthrough

Walkthrough

The GitHub Actions workflow is updated to explicitly authenticate the "Publish draft release" step using the GitHub App token generated by the prior create-github-app-token step, replacing reliance on default token behavior for subsequent API calls.

Changes

Cohort / File(s) Summary
Workflow Authentication
.github/workflows/pull-requests-release.yaml		 Updated "Publish draft release" GitHub Script step to explicitly use GitHub App token (steps.app-token.outputs.token) via github-token parameter instead of default token behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A token so fine, now explicitly mine,
No guessing the default, we'll use the divine,
GitHub App flows with authentication bright,
One line of clarity sets everything right! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically identifies the main change: passing the app token to the 'Publish draft release' step in the CI workflow, which directly matches the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/ci-publish-draft-token

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.

Comment @coderabbitai help to get the list of available commands and usage tips.

@dosubot dosubot Bot added the area/release Issues or PRs related to release tooling (changelog, backport, release pipeline) label Apr 29, 2026
@dosubot dosubot Bot added the lgtm This PR has been approved by a maintainer label Apr 29, 2026
IvanHunters
IvanHunters approved these changes Apr 29, 2026
View reviewed changes

@IvanHunters IvanHunters left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Root cause is well-documented (the fix was present in 4db55ac, dropped silently in 66a756b, and missed by the App-token migration in f96b2da because that migration only touched steps that already had github-token:). One-line fix is correct — the step needs the app token to see draft releases via listReleases.

LGTM

@myasnikovdaniil
myasnikovdaniil merged commit d6cafd7 into main Apr 30, 2026
15 checks passed
@myasnikovdaniil
myasnikovdaniil deleted the fix/ci-publish-draft-token branch April 30, 2026 09:57
@myasnikovdaniil myasnikovdaniil added kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/backport-previous Categorizes issue or PR as requiring a backport to the previous release line labels May 6, 2026
@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

Successfully created backport PR for release-1.3:

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

Successfully created backport PR for release-1.2:

This was referenced May 6, 2026
Merged
Merged
myasnikovdaniil added a commit that referenced this pull request May 6, 2026
@myasnikovdaniil
[Backport release-1.3] fix(ci): pass app token to Publish draft relea…
0380b40 
…se step (#2572)

# Description
Backport of #2532 to `release-1.3`.
myasnikovdaniil added a commit that referenced this pull request May 6, 2026
@myasnikovdaniil
[Backport release-1.2] fix(ci): pass app token to Publish draft relea…
de4959a 
…se step (#2573)

# Description
Backport of #2532 to `release-1.2`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@IvanHunters IvanHunters IvanHunters approved these changes
@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner
@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp is a code owner
@lexfrei Aleksei Sviridkin (lexfrei) Awaiting requested review from lexfrei lexfrei is a code owner
@androndo Andrey Kolkov (androndo) Awaiting requested review from androndo
@sircthulhu Kirill Ilin (sircthulhu) Awaiting requested review from sircthulhu

Assignees

No one assigned

Labels

area/ci Issues or PRs related to CI workflows, GitHub Actions, automation area/release Issues or PRs related to release tooling (changelog, backport, release pipeline) kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/backport-previous Categorizes issue or PR as requiring a backport to the previous release line kind/bug Categorizes issue or PR as related to a bug lgtm This PR has been approved by a maintainer size/XS This PR changes 0-9 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@myasnikovdaniil @IvanHunters