Skip to content

chore: release with the built-in GitHub token #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kudo merged 2 commits into from
Oct 20, 2026
Merged

chore: release with the built-in GitHub token #362

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
48a8b62
chore: release with the built-in GitHub token
Kudo Oct 20, 2026
c10e839
chore: harden release jobs that hold a write token
Kudo Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 14 additions & 21 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,11 +35,17 @@ jobs:
publish:
if: ${{ github.ref == 'refs/heads/main' && github.event.inputs.release == 'release' }}
runs-on: ubuntu-latest
# semantic-release pushes the release commit and tag, and labels and comments on released issues and PRs
permissions:
contents: write
issues: write
pull-requests: write
steps:
- name: 🏗 Setup repo
uses: actions/checkout@v4
with:
token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
# Keep the token out of .git/config, semantic-release adds it to the push URL itself
persist-credentials: false

- name: 🏗 Setup runner
uses: ./.github/actions/setup
Expand All @@ -50,7 +56,7 @@ jobs:
- name: 📋 Release code
run: bun semantic-release
env:
GITHUB_TOKEN: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ github.token }}
GIT_AUTHOR_NAME: Expo CI
GIT_AUTHOR_EMAIL: support+ci@expo.dev
GIT_COMMITTER_NAME: Expo CI
Expand All @@ -59,33 +65,18 @@ jobs:
tags:
needs: publish
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: 🏗 Setup repo
uses: actions/checkout@v4
with:
token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}

- name: 🏗 Setup runner
uses: ./.github/actions/setup

- name: 👷 Force repo to latest
run: git fetch --all && git pull

- name: 📦 Install dependencies
run: bun install

- name: 📦 Install semver
run: bun add --dev semver

- name: 🕵️ Resolve major version
uses: actions/github-script@v7
id: version
with:
result-encoding: string
script: |
const semver = require('semver')
const { version } = require('./package.json')
return semver.major(version)
run: echo "major=$(node -p "require('./package.json').version.split('.')[0]")" >> "$GITHUB_OUTPUT"

- name: 👷 Configure git
run: |
Expand All @@ -96,4 +87,6 @@ jobs:
run: git clean . -xdf && git reset --hard HEAD && git pull && git fetch --tags

- name: 📋 Update tags
run: git tag --force v${{ steps.version.outputs.result }} && git push --force --tags
run: git tag --force "v$MAJOR" && git push --force origin "v$MAJOR"
env:
MAJOR: ${{ steps.version.outputs.major }}
Loading