Skip to content

Use a GitHub App for authentication during release creation#18711

Open
zanieb wants to merge 2 commits intomainfrom
zb/release-app
Open

Use a GitHub App for authentication during release creation#18711
zanieb wants to merge 2 commits intomainfrom
zb/release-app

Conversation

@zanieb
Copy link
Copy Markdown
Member

@zanieb zanieb commented Mar 25, 2026 •
edited
Loading

In short, we can

  1. Create a GitHub Application (astral-release-authenticator)
  2. Use a GitHub ruleset to prevent all tag creation with a bypass for the above actor
  3. Use actions/create-github-app-token to create an ephemeral token during a release workflow.

This prevents anyone from creating releases or pushing tags manually.

github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 25, 2026
View reviewed changes
@zanieb zanieb added build:skip-release Disable building release binaries for a pull request labels Mar 25, 2026
@zanieb zanieb marked this pull request as ready for review March 25, 2026 12:54
@konstin konstin requested a review from woodruffw March 25, 2026 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@woodruffw woodruffw Awaiting requested review from woodruffw

Assignees

No one assigned

Labels

build:skip-release Disable building release binaries for a pull request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zanieb @github-advanced-security