authorgravatar for me@t3.ggTheo Browne <me@t3.gg> 2026-08-05 05:36:10-04:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-08-05 02:36:10-07:00
log9697b765e5c32232e96514e38b6ecfac351d5a8f
tree001f41f425c4e7af1adaa33e50a85c7cc71b3b90
parent9d9a872bccc6ed099de85a121ab042c9e078987e
signature Signed by PGP key B5690EEEBB952194

fix(ci): isolate releases from shared API rate limits (#5394)

2 files changed, 10 insertions(+), 15 deletions(-)

.github/workflows/release.yml+6-12
...@@ -747,15 +747,9 @@ jobs:...@@ -747,15 +747,9 @@ jobs:
747 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' && needs.publish_cli.result == 'success' }}747 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' && needs.publish_cli.result == 'success' }}
748 runs-on: blacksmith-8vcpu-ubuntu-2404748 runs-on: blacksmith-8vcpu-ubuntu-2404
749 timeout-minutes: 10749 timeout-minutes: 10
750 permissions:
751 contents: write
750 steps:752 steps:
751 - id: app_token
752 name: Mint release app token
753 uses: actions/create-github-app-token@v2
754 with:
755 app-id: ${{ secrets.RELEASE_APP_ID }}
756 private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
757 owner: ${{ github.repository_owner }}
758
759 - name: Checkout753 - name: Checkout
760 uses: actions/checkout@v6754 uses: actions/checkout@v6
761 with:755 with:
...@@ -823,7 +817,7 @@ jobs:...@@ -823,7 +817,7 @@ jobs:
823817
824 - name: Publish release818 - name: Publish release
825 if: needs.preflight.outputs.previous_tag != ''819 if: needs.preflight.outputs.previous_tag != ''
826 uses: softprops/action-gh-release@v2820 uses: softprops/action-gh-release@v3
827 with:821 with:
828 tag_name: ${{ needs.preflight.outputs.tag }}822 tag_name: ${{ needs.preflight.outputs.tag }}
829 target_commitish: ${{ needs.preflight.outputs.ref }}823 target_commitish: ${{ needs.preflight.outputs.ref }}
...@@ -840,11 +834,11 @@ jobs:...@@ -840,11 +834,11 @@ jobs:
840 release-assets/*.blockmap834 release-assets/*.blockmap
841 release-assets/*.yml835 release-assets/*.yml
842 fail_on_unmatched_files: true836 fail_on_unmatched_files: true
843 token: ${{ steps.app_token.outputs.token }}837 token: ${{ github.token }}
844838
845 - name: Publish first release839 - name: Publish first release
846 if: needs.preflight.outputs.previous_tag == ''840 if: needs.preflight.outputs.previous_tag == ''
847 uses: softprops/action-gh-release@v2841 uses: softprops/action-gh-release@v3
848 with:842 with:
849 tag_name: ${{ needs.preflight.outputs.tag }}843 tag_name: ${{ needs.preflight.outputs.tag }}
850 target_commitish: ${{ needs.preflight.outputs.ref }}844 target_commitish: ${{ needs.preflight.outputs.ref }}
...@@ -860,7 +854,7 @@ jobs:...@@ -860,7 +854,7 @@ jobs:
860 release-assets/*.blockmap854 release-assets/*.blockmap
861 release-assets/*.yml855 release-assets/*.yml
862 fail_on_unmatched_files: true856 fail_on_unmatched_files: true
863 token: ${{ steps.app_token.outputs.token }}857 token: ${{ github.token }}
864858
865 deploy_web:859 deploy_web:
866 name: Deploy hosted web app860 name: Deploy hosted web app
docs/operations/release.md+4-3
...@@ -34,14 +34,15 @@ This document covers the unified release workflow for stable and nightly desktop...@@ -34,14 +34,15 @@ This document covers the unified release workflow for stable and nightly desktop
3434
35## Required release credentials35## Required release credentials
3636
37The release workflow requires these GitHub Actions secrets in addition to the platform and deployment37Stable releases require these GitHub Actions secrets in addition to the platform and deployment
38credentials documented below:38credentials documented below:
3939
40- `RELEASE_APP_ID`40- `RELEASE_APP_ID`
41- `RELEASE_APP_PRIVATE_KEY`41- `RELEASE_APP_PRIVATE_KEY`
4242
43The GitHub Release job uses them to mint the token that publishes release assets. Stable releases use43The finalize job uses them to commit and push aligned package versions to `main` as the Release App.
44them again in the finalize job, which can commit and push aligned package versions to `main`.44GitHub Release publication uses the repository-scoped workflow token so it has a rate-limit quota
45independent from the shared Release App installation.
4546
46## T3 Connect relay deployment47## T3 Connect relay deployment
4748