From 9cce779ed692d05dc8da18c81fc880246224832d Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Thu, 10 Sep 2026 23:26:34 -0700 Subject: [PATCH] fix(ci): align release bootstrap with the current GitHub App --- .github/repository-settings.toml | 2 +- .github/workflows/release-please.yml | 4 ++-- DELETE_ME.md | 4 +++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/repository-settings.toml b/.github/repository-settings.toml index 01ee72c..a4ffb12 100644 --- a/.github/repository-settings.toml +++ b/.github/repository-settings.toml @@ -95,7 +95,7 @@ block_force_pushes = true bypass = [ { type = "repository_admin_role", mode = "always" }, # Release Please needs tag-creation bypass because tags are protected here. - { type = "app", slug = "meigma-release-please", mode = "always" }, + { type = "app", slug = "meigma-release", mode = "always" }, ] [rulesets.tags_default.status_checks] diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index c638b0a..e3807ea 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -1,5 +1,5 @@ # Required release app settings: -# - vars.MEIGMA_RELEASE_APP_ID +# - vars.MEIGMA_RELEASE_APP_CLIENT_ID # - secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY # - protected-tag ruleset bypass for the release app, because this workflow # creates protected v* tags after the release PR is merged. @@ -31,7 +31,7 @@ jobs: id: release-app uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ vars.MEIGMA_RELEASE_APP_ID }} + client-id: ${{ vars.MEIGMA_RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY }} - name: Run Release Please diff --git a/DELETE_ME.md b/DELETE_ME.md index 9b8cff6..39a5416 100644 --- a/DELETE_ME.md +++ b/DELETE_ME.md @@ -165,7 +165,7 @@ For a binary plus container release: - Update `apko.yaml`: local package, entry point, command, image annotations, and source URL. - Update the release, dry-run, and security-scan workflows: image name, binary validation paths, smoke commands, and summaries. - Update `release-please-config.json` and keep `.release-please-manifest.json` at the intended initial baseline. -- Configure the release GitHub App credentials, protected-tag bypass, and package permissions. +- Configure the release GitHub App credentials, protected-tag bypass, and package permissions. Release Please expects `vars.MEIGMA_RELEASE_APP_CLIENT_ID` and `secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY`. Install the app on the generated repository and explicitly grant that repository access to these values; template generation does not copy credential access or app installations. If the project is binary-only, remove the melange/apko jobs, image scan, image configuration, and container required checks. If it is container-only, remove GoReleaser, `ghd.toml`, binary jobs, and binary required checks. Keep the release dry run for every release path that remains. @@ -173,6 +173,8 @@ If the project is binary-only, remove the melange/apko jobs, image scan, image c Rewrite `README.md` and `docs/docs/` for the real capabilities and retained transports. Update `docs/mkdocs.yml` (`site_url`, `repo_name`, `repo_url`, and `edit_uri`) for the generated repository. Review `CONTRIBUTING.md` and `SECURITY.md` and update the license holder if needed. +If you retain the Pages workflow, enable GitHub Pages for the generated repository and select **GitHub Actions** as its build source. Template generation does not copy this repository setting. + Link to the [canonical CodeMode documentation](https://meigma.github.io/codemode/) for the complete runtime, type, MCP tool, and security contracts rather than copying the upstream reference into the generated project. ## Regenerate and verify