Skip to content

fix(gha): mint the Go-publish token from the CDKTN Maintainers app #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
so0k merged 1 commit into from
Aug 6, 2026
Merged

fix(gha): mint the Go-publish token from the CDKTN Maintainers app #369

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 13 additions & 10 deletions .github/workflows/release-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,13 @@ on:
required: true
NUGET_API_KEY:
required: true
# Credentials of the open-constructs-cdktn GitHub App; release_golang
# mints a per-run installation token from them. Callers pass these via
# `secrets: inherit`.
GH_APP_ID:
# Credentials of the CDKTN Maintainers GitHub App (the same app
# release-please.yml and pnpm-upgrade.yml authenticate with);
# release_golang mints a per-run installation token from them. Callers
# pass these via `secrets: inherit`.
CDKTN_MAINTAINERS_APP_ID:
required: true
GH_APP_PRIVATE_KEY:
CDKTN_MAINTAINERS_APP_PRIVATE_KEY:
required: true

jobs:
Expand Down Expand Up @@ -199,17 +200,19 @@ jobs:
with:
name: ${{ inputs.dist_artifact_name }}
path: dist
# Minted fresh each run by the open-constructs-cdktn GitHub App, replacing
# the TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN user PAT that silently expired
# Minted fresh each run by the CDKTN Maintainers GitHub App — the app
# release-please.yml already authenticates with — replacing the
# TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN user PAT that silently expired
# and failed every Go publish with git prompting for a password (#66).
# Scoped to the one repo publib-golang pushes to; expires after an hour,
# which comfortably outlives this job.
# which comfortably outlives this job. The app's installation must
# include cdk-terrain-go or this step 404s at the mint.
- name: Generate GitHub App token
id: go-app-token
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
app-id: ${{ secrets.CDKTN_MAINTAINERS_APP_ID }}
private-key: ${{ secrets.CDKTN_MAINTAINERS_APP_PRIVATE_KEY }}
owner: open-constructs
repositories: cdk-terrain-go
# Push access to the Go bindings repo is all publib-golang needs;
Expand Down
Loading