Skip to content

ci(release): migrate to Craft reusable workflow #148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vaind merged 3 commits into from
Feb 2, 2026
Merged

ci(release): migrate to Craft reusable workflow #148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
48e18ef
ci(release): migrate to Craft reusable workflow
vaind Feb 2, 2026
97c2aff
chore: bump craft minVersion to 2.20.1
vaind Feb 2, 2026
78f9dd2
fix: add empty permissions block to satisfy CodeQL
vaind Feb 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .craft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
minVersion: 0.23.1
minVersion: 2.20.1
changelogPolicy: auto
preReleaseCommand: pwsh -cwa ''
artifactProvider:
Expand Down
33 changes: 8 additions & 25 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,39 +1,22 @@
name: Release

permissions:
contents: read
contents: write

on:
workflow_dispatch:
inputs:
version:
description: Version to release
required: true
description: 'Version to release (automatically inferred form commits if not provided)'
required: false
force:
description: Force a release even when there are release-blockers (optional)
required: false

jobs:
release:
runs-on: ubuntu-latest
name: "Release a new version"
steps:
- name: Get auth token
id: token
uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0

- name: Prepare release
uses: getsentry/action-prepare-release@v1
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ github.event.inputs.version }}
force: ${{ github.event.inputs.force }}
uses: getsentry/craft/.github/workflows/release.yml@v2
with:
version: ${{ inputs.version || 'auto' }}
force: ${{ inputs.force || 'false' }}
secrets: inherit
Copy link
Member

@BYK BYK Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You need the special token for release bot otherwise your releases will fail

Copy link
Collaborator

@jpnurmi jpnurmi Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like this?

GraphQL: Resource not accessible by integration (createIssue)
Error: Process completed with exit code 1.

https://github.com/getsentry/github-workflows/actions/workflows/release.yml

Copy link
Contributor Author

@vaind vaind Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@BYK I'm confused why do docs say to use the reusable workflow as the recommended way to set up?

image

FWIW I've ran this by Claude and this seams reasonable:

The problem in Craft's release.yml:

This step ONLY runs for the Craft repo itself

- name: Get auth token                                                                                                                                                                                                                                                                                                                
  id: token
  if: github.event_name == 'workflow_dispatch' && github.repository == 'getsentry/craft'
  uses: actions/create-github-app-token@...
  with:
    app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
    private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

For external repos: uses github.token which can't create issues in getsentry/publish

- name: Prepare release
  if: github.repository != 'getsentry/craft'
  env:
    GITHUB_TOKEN: ${{ github.token }}  # <-- this is the problem

Since secrets: inherit already passes SENTRY_RELEASE_BOT_PRIVATE_KEY through, and vars.SENTRY_RELEASE_BOT_CLIENT_ID is available at the org level, the credentials are already there — Craft just doesn't use them for external repos.

What would need to change in Craft:

  1. Remove the repository guard on the token step — or add a second token step for external repos:
  - name: Get auth token
    id: token
  - if: github.event_name == 'workflow_dispatch' && github.repository == 'getsentry/craft'
  - if: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY != '' }}
  1. Use the app token (with fallback) in the external repos step:
- name: Prepare release
  if: github.repository != 'getsentry/craft'
  env:
-      GITHUB_TOKEN: ${{ github.token }}
+      GITHUB_TOKEN: ${{ steps.token.outputs.token || github.token }}
  1. Same for the checkout step (already correct — it does ${{ steps.token.outputs.token || github.token }}).

An alternative Craft-side approach would be to add an explicit token secret to workflow_call:

  workflow_call:
    secrets:
      token:
        description: 'Token with cross-repo issue creation permissions'
        required: false

Then callers would generate the token themselves and pass it. But that's more boilerplate per-repo and defeats the purpose of the reusable workflow simplifying things.

Loading