From fe3c7a46f72e91bc42cba03c6a352ca5df6ee9ec Mon Sep 17 00:00:00 2001 From: Marina Lang Date: Tue, 4 Aug 2026 16:31:48 +0200 Subject: [PATCH] fix: Update version bump workflow to use application token --- .github/workflows/bump-version.yml | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml index c6b8d6a..4dcf031 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/bump-version.yml @@ -12,9 +12,10 @@ jobs: name: Bump and Release permissions: contents: write - # Prevent circular workflow run. Keyed on the commit message rather than the - # pusher, which is no longer a fixed user name. (Belt and braces: pushes made - # with GITHUB_TOKEN do not trigger workflows.) + # Prevent circular workflow run. Keyed on the commit message, not the pusher: + # the bump is pushed by the emnify-github-actions App (pusher name + # emnify-github-actions[bot], which does not match the old 'emnify-gha' + # check), and App pushes DO re-trigger workflows. if: "!contains(github.event.head_commit.message, '[Automated] Version Bump')" runs-on: ubuntu-latest @@ -24,7 +25,19 @@ jobs: with: access_token: ${{ github.token }} + # Installation token for the emnify-github-actions App, which is on the + # bypass list for protected main and so can push the version bump. Replaces + # the expired EMNIFY_GITHUB_ACTIONS_TOKEN PAT. + - name: Retrieve application token + id: get_token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.EMNIFY_GITHUB_ACTIONS_APP_ID }} + private-key: ${{ secrets.EMNIFY_GITHUB_ACTIONS_APP_PEM }} + - uses: actions/checkout@v4 + with: + token: ${{ steps.get_token.outputs.token }} - name: Bump version and push tag id: tag_version