Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Since we have branch protection enabled and we need to push new commit as part of the release into the protected branch (
main
), we run into some limitations as far as how this can be handled in GitHub Actions.I have already generated the deploy key and added to the repo + added the private part as a secret.
This should provide a reasonable balance between convenience and security, since we can easily rotate the deploy key in the context of the repository (rather than under a separate bot GH account) and still keep the key scoped to the repository.
The new time-scoped granular PATs would probably be even more secure, but the rotation workflow seems painfully manual.
Hopefully GitHub will eventually come up with some way of allowing the workflow token to bypass the branch protection and then we will have the best solution where no manual key/token management is needed and the token only has the necessary scope as per
permission
block in the workflow YAML file.