From d60de6d463340996a1da13c49f1079856f2e81c3 Mon Sep 17 00:00:00 2001 From: Pierre Brisorgueil Date: Wed, 21 Oct 2026 19:00:59 +0200 Subject: [PATCH 1/2] ci(release): do not persist the release token in .git/config semantic-release reads GITHUB_TOKEN from the Release step env, so the checkout needs no credentials; npm ci and the tests no longer see the PAT. Same as Node. Claude-Session: https://claude.ai/code/session_01WUHv6mXE1DorM94XZFAv5y --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 682bb0838..7809f2c1c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }} + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@v4 From d955e92fd1af01874cc2f42fdfe4002f5a0ed486 Mon Sep 17 00:00:00 2001 From: Pierre Brisorgueil Date: Wed, 21 Oct 2026 19:09:16 +0200 Subject: [PATCH 2/2] ci(release): require the GH_TOKEN PAT, read-only generated token The GITHUB_TOKEN fallback could never push the release commit past the "CI required" ruleset, so it only widened the job permissions. Claude-Session: https://claude.ai/code/session_01WUHv6mXE1DorM94XZFAv5y --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7809f2c1c..d2f39c0af 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,10 +8,10 @@ on: # Permet aussi de déclencher manuellement depuis GitHub Actions UI workflow_dispatch: +# The release pushes with the GH_TOKEN PAT (an admin, so it bypasses the +# "CI required" ruleset); the generated token stays read-only. permissions: - contents: write - issues: write - pull-requests: write + contents: read jobs: release: @@ -44,5 +44,5 @@ jobs: - name: Release env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} run: npx semantic-release