From 48a8b6206ea55663b9682ce60934bb5bf0ef54ad Mon Sep 17 00:00:00 2001
From: Kudo Chien <kudo@expo.dev>
Date: Wed, 21 Oct 2026 01:05:58 +0800
Subject: [PATCH 1/2] chore: release with the built-in GitHub token

The expo-bot token lost write access to this repo, so releases fail
with EGITNOPERMISSION. The built-in token already has the access the
release needs.
---
 .github/workflows/release.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1a983553..466c44070 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,11 +35,14 @@ jobs:
   publish:
     if: ${{ github.ref == 'refs/heads/main' && github.event.inputs.release == 'release' }}
     runs-on: ubuntu-latest
+    # semantic-release pushes the release commit and tag, and labels and comments on released issues and PRs
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
 
       - name: 🏗 Setup runner
         uses: ./.github/actions/setup
@@ -50,7 +53,7 @@ jobs:
       - name: 📋 Release code
         run: bun semantic-release
         env:
-          GITHUB_TOKEN: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           GIT_AUTHOR_NAME: Expo CI
           GIT_AUTHOR_EMAIL: support+ci@expo.dev
           GIT_COMMITTER_NAME: Expo CI
@@ -59,11 +62,11 @@ jobs:
   tags:
     needs: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
 
       - name: 🏗 Setup runner
         uses: ./.github/actions/setup

From c10e839c3add758c28df3f2d6c1b4c477624879d Mon Sep 17 00:00:00 2001
From: Kudo Chien <kudo@expo.dev>
Date: Wed, 21 Oct 2026 01:10:52 +0800
Subject: [PATCH 2/2] chore: harden release jobs that hold a write token

Keep the token out of .git/config in publish, push only the major tag,
and stop installing packages from npm in the tags job.
---
 .github/workflows/release.yml | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 466c44070..59d710c96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,6 +43,9 @@ jobs:
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
+        with:
+          # Keep the token out of .git/config, semantic-release adds it to the push URL itself
+          persist-credentials: false
 
       - name: 🏗 Setup runner
         uses: ./.github/actions/setup
@@ -68,27 +71,12 @@ jobs:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
 
-      - name: 🏗 Setup runner
-        uses: ./.github/actions/setup
-
       - name: 👷 Force repo to latest
         run: git fetch --all && git pull
 
-      - name: 📦 Install dependencies
-        run: bun install
-
-      - name: 📦 Install semver
-        run: bun add --dev semver
-
       - name: 🕵️ Resolve major version
-        uses: actions/github-script@v7
         id: version
-        with:
-          result-encoding: string
-          script: |
-            const semver = require('semver')
-            const { version } = require('./package.json')
-            return semver.major(version)
+        run: echo "major=$(node -p "require('./package.json').version.split('.')[0]")" >> "$GITHUB_OUTPUT"
 
       - name: 👷 Configure git
         run: |
@@ -99,4 +87,6 @@ jobs:
         run: git clean . -xdf && git reset --hard HEAD && git pull && git fetch --tags
 
       - name: 📋 Update tags
-        run: git tag --force v${{ steps.version.outputs.result }} && git push --force --tags
+        run: git tag --force "v$MAJOR" && git push --force origin "v$MAJOR"
+        env:
+          MAJOR: ${{ steps.version.outputs.major }}