authorgravatar for me@t3.ggTheo Browne <me@t3.gg> 2026-08-05 05:36:10-04:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-08-05 02:36:10-07:00
log9697b765e5c32232e96514e38b6ecfac351d5a8f
tree001f41f425c4e7af1adaa33e50a85c7cc71b3b90
parent9d9a872bccc6ed099de85a121ab042c9e078987e
signature Signed by PGP key B5690EEEBB952194

fix(ci): isolate releases from shared API rate limits (#5394)

2 files changed, 10 insertions(+), 15 deletions(-)

.github/workflows/release.yml+6-12
......@@ -747,15 +747,9 @@ jobs:
747747 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' && needs.publish_cli.result == 'success' }}
748748 runs-on: blacksmith-8vcpu-ubuntu-2404
749749 timeout-minutes: 10
750 permissions:
751 contents: write
750752 steps:
751 - id: app_token
752 name: Mint release app token
753 uses: actions/create-github-app-token@v2
754 with:
755 app-id: ${{ secrets.RELEASE_APP_ID }}
756 private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
757 owner: ${{ github.repository_owner }}
758
759753 - name: Checkout
760754 uses: actions/checkout@v6
761755 with:
......@@ -823,7 +817,7 @@ jobs:
823817
824818 - name: Publish release
825819 if: needs.preflight.outputs.previous_tag != ''
826 uses: softprops/action-gh-release@v2
820 uses: softprops/action-gh-release@v3
827821 with:
828822 tag_name: ${{ needs.preflight.outputs.tag }}
829823 target_commitish: ${{ needs.preflight.outputs.ref }}
......@@ -840,11 +834,11 @@ jobs:
840834 release-assets/*.blockmap
841835 release-assets/*.yml
842836 fail_on_unmatched_files: true
843 token: ${{ steps.app_token.outputs.token }}
837 token: ${{ github.token }}
844838
845839 - name: Publish first release
846840 if: needs.preflight.outputs.previous_tag == ''
847 uses: softprops/action-gh-release@v2
841 uses: softprops/action-gh-release@v3
848842 with:
849843 tag_name: ${{ needs.preflight.outputs.tag }}
850844 target_commitish: ${{ needs.preflight.outputs.ref }}
......@@ -860,7 +854,7 @@ jobs:
860854 release-assets/*.blockmap
861855 release-assets/*.yml
862856 fail_on_unmatched_files: true
863 token: ${{ steps.app_token.outputs.token }}
857 token: ${{ github.token }}
864858
865859 deploy_web:
866860 name: Deploy hosted web app
docs/operations/release.md+4-3
......@@ -34,14 +34,15 @@ This document covers the unified release workflow for stable and nightly desktop
3434
3535## Required release credentials
3636
37The release workflow requires these GitHub Actions secrets in addition to the platform and deployment
37Stable releases require these GitHub Actions secrets in addition to the platform and deployment
3838credentials documented below:
3939
4040- `RELEASE_APP_ID`
4141- `RELEASE_APP_PRIVATE_KEY`
4242
43The GitHub Release job uses them to mint the token that publishes release assets. Stable releases use
44them again in the finalize job, which can commit and push aligned package versions to `main`.
43The finalize job uses them to commit and push aligned package versions to `main` as the Release App.
44GitHub Release publication uses the repository-scoped workflow token so it has a rate-limit quota
45independent from the shared Release App installation.
4546
4647## T3 Connect relay deployment
4748