From d17cd7587e0583ef40410e5ad7ce57bd7c5a669b Mon Sep 17 00:00:00 2001
From: maxakuru <maxed@adobe.com>
Date: Thu, 10 Sep 2026 12:37:37 -0400
Subject: [PATCH] ci: authenticate semantic-release push with GitHub App token

The main ruleset now requires PRs, blocking semantic-release's direct
push to main (GH013). Mint a GitHub App token (a ruleset bypass actor)
via actions/create-github-app-token and use it for checkout and
semantic-release instead of the default GITHUB_TOKEN.
---
 .github/workflows/deploy_prod.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy_prod.yml b/.github/workflows/deploy_prod.yml
index fbe6fb7..cfe340e 100644
--- a/.github/workflows/deploy_prod.yml
+++ b/.github/workflows/deploy_prod.yml
@@ -28,7 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
+      - name: Generate release token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
       - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
@@ -53,7 +62,7 @@ jobs:
       - name: Semantic Release
         run: npm run semantic-release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           AIO_RUNTIME_NAMESPACE: ${{ secrets.AIO_RUNTIME_NAMESPACE_PROD }}
           AIO_RUNTIME_AUTH: ${{ secrets.AIO_RUNTIME_AUTH_PROD }}
           AIO_PROJECT_ID: ${{ secrets.AIO_PROJECT_ID_PROD }}