From ea35ec14578af099e2eaa77575266e65b1b6c75a Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Fri, 24 Jul 2026 16:43:57 +0530 Subject: [PATCH] SK-2986 use PAT for release version-bump push to bypass branch protection Branch-protection rulesets now enforce PR + approval + a build status check on main (staged). The automated version-bump commit is pushed directly to main as github-actions[bot], which is not a ruleset bypass actor, so the push would be rejected. Point the release checkout at PAT_ACTIONS (a repo-admin credential) so its token is persisted and reused for the push, satisfying the ruleset's repo-admin bypass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d2ff45f..d4b9794 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,6 +16,11 @@ jobs: with: ref: main fetch-depth: 0 + # Persist an admin credential so the automated version-bump push + # below satisfies the branch-protection ruleset's repo-admin bypass; + # the default GITHUB_TOKEN (github-actions[bot]) is not a bypass + # actor and would be rejected once PR enforcement is active. SK-2986. + token: ${{ secrets.PAT_ACTIONS }} - uses: actions/setup-node@v1 with: node-version: 14.21.3