fix(ci): push the release-cut baked manifest as a ruleset bypass bot (#5358)

* fix(ci): push the release-cut baked manifest as a ruleset bypass bot

bake-plugin-previews-release.yml renders every preview on a release/** cut and
pushes the authoritative manifest straight onto the release branch. But release/**
is guarded by the 'Protected branches (preview/*, release/v*)' ruleset whose
pull_request rule rejects direct pushes — and the workflow pushed with
PREVIEW_BAKE_TOKEN||github.token, i.e. github-actions[bot], which is NOT a bypass
actor. So the writeback failed with 'GH013: Repository rule violations found for
refs/heads/release/vX.Y.Z' (observed on release/v0.14.2), and the release branch's
bundled data/plugin-previews/manifest.json was never refreshed — the packaged app
then falls back to rendering each preview as a live iframe (pathological for the
WebGL example templates).

Mint an open-design-bot token (app id 3640364 — already a bypass actor on that
ruleset, same App the metrics/blog/contributors workflows use) after the render
and push with it via an explicit token URL. persist-credentials: false on checkout
so the leftover github.token extraheader can't override the inline bot token on
push (same failure mode fixed in #5357). No ruleset change required — the bypass
actor already exists; the workflow just wasn't using it.

* test(ci): lock the release-cut bake's ruleset-bypass push contract

Per .github/AGENTS.md, cross-workflow auth changes must update topology coverage
in e2e/tests/packaged-smoke-workflow.test.ts rather than rely on YAML review.
Add a companion assertion (alongside the existing bake-plugin-previews.yml one)
that locks bake-plugin-previews-release.yml's three co-dependent auth invariants:
persist-credentials: false on checkout, the open-design-bot token mint
(BOT_APP_CLIENT_ID/BOT_APP_PRIVATE_KEY — the App that is a ruleset bypass actor,
not RELEASE_BOT_APP_ID), and the explicit x-access-token:${BOT_TOKEN} push. A
refactor dropping any one silently reintroduces the GH013 rejection that stranded
release/v0.14.2's manifest.

Author: lefarcen

.github/workflows/bake-plugin-previews-release.yml

@@ -40,7 +40,16 @@ jobs:
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
-          token: ${{ secrets.PREVIEW_BAKE_TOKEN || github.token }}
+          # Read-only clone with the default token, but do NOT persist it as a
+          # github.com credential. release/** is guarded by the "Protected
+          # branches (preview/*, release/v*)" ruleset (deletion / non_fast_forward
+          # / pull_request), so a direct push is rejected (GH013) unless the pusher
+          # is a bypass actor. github-actions[bot] is NOT one — so the manifest
+          # writeback below force-authenticates as open-design-bot, which IS a
+          # bypass actor, via an explicit token URL. A persisted github.token
+          # extraheader would override that inline token on push (see #5357), so
+          # drop it; nothing between here and the push needs the persisted cred.
+          persist-credentials: false
 
       - name: Loop guard — skip the bake bot's own manifest commit
         id: guard
@@ -71,8 +80,26 @@ jobs:
           r2-bucket: ${{ secrets.CLOUDFLARE_R2_REPOSITORY_ASSETS_BUCKET }}
           r2-endpoint: ${{ secrets.CLOUDFLARE_R2_REPOSITORY_ASSETS_URL }}
 
+      - name: Mint the open-design-bot token for the release-branch push
+        if: ${{ steps.guard.outputs.skip != 'true' }}
+        id: bot
+        # open-design-bot (app id 3640364) is a bypass actor on the
+        # "Protected branches (preview/*, release/v*)" ruleset, so its push clears
+        # the pull_request rule that rejects github-actions[bot] (GH013). The
+        # release bake pushes the manifest directly (it then rides the non-squash
+        # release back-merge to main). Minted here — after the long render, not at
+        # job start — because an App token lives ~1h and the render can run long.
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          owner: nexu-io
+          repositories: open-design
+
       - name: Commit the authoritative manifest onto the release branch
         if: ${{ steps.guard.outputs.skip != 'true' }}
+        env:
+          BOT_TOKEN: ${{ steps.bot.outputs.token }}
         run: |
           OLD=data/plugin-previews/manifest.json
           NEW=.tmp/plugin-previews/manifest.json
@@ -89,4 +116,7 @@ jobs:
           git config user.email "bot@open-design.ai"
           git add "$OLD"
           git commit -m "chore(plugin-previews): refresh baked preview manifest (release cut)"
-          git push origin "HEAD:${GITHUB_REF#refs/heads/}"
+          # Push as open-design-bot (a ruleset bypass actor) via an explicit token
+          # URL. A plain `git push origin` would authenticate as github-actions[bot]
+          # and be rejected by the release/** pull_request rule (GH013).
+          git push "https://x-access-token:${BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF#refs/heads/}"

e2e/tests/packaged-smoke-workflow.test.ts

@@ -29,6 +29,12 @@ const bakePreviewsAutomergeWorkflowPath = join(
   "bake-plugin-previews-automerge.yml",
 );
 const bakePreviewsWorkflowPath = join(workspaceRoot, ".github", "workflows", "bake-plugin-previews.yml");
+const bakePreviewsReleaseWorkflowPath = join(
+  workspaceRoot,
+  ".github",
+  "workflows",
+  "bake-plugin-previews-release.yml",
+);
 const finalizeReleaseWorkflowPath = join(workspaceRoot, ".github", "workflows", "finalize-release.yml");
 const handoffScriptPath = join(workspaceRoot, ".github", "scripts", "handoff.py");
 const releaseBetaWorkflowPath = join(workspaceRoot, ".github", "workflows", "release-beta.yml");
@@ -814,6 +820,32 @@ process.stdin.on("end", () => {
     expect(workflow).not.toContain("git/ref/heads/main");
   });
 
+  it("[P2] keeps the release-cut bake pushing its manifest as a ruleset bypass bot", async () => {
+    // release/** is guarded by the "Protected branches (preview/*, release/v*)" ruleset whose
+    // pull_request rule rejects a direct push (GH013) unless the pusher is a bypass actor. The
+    // release-cut bake writes the authoritative manifest straight onto the release branch, so it
+    // must push as open-design-bot — a bypass actor on that ruleset — not github-actions[bot],
+    // which is NOT and gets rejected (this stranded release/v0.14.2's manifest). These three auth
+    // invariants only work together; a refactor that drops any one silently reintroduces the
+    // GH013 regression, so lock them here rather than rely on YAML review.
+    const workflow = await readFile(bakePreviewsReleaseWorkflowPath, "utf8");
+
+    // 1. Checkout must NOT persist GITHUB_TOKEN: its http.extraheader would override the inline bot
+    //    token on push and re-authenticate as github-actions[bot] (the same override fixed in the
+    //    post-merge bake — #5357).
+    expect(workflow).toContain("persist-credentials: false");
+    // 2. The run mints an open-design-bot token via the BOT_APP_* creds — the App that IS a bypass
+    //    actor on the release ruleset. RELEASE_BOT_APP_ID (used by the post-merge bake) is a
+    //    different App and is NOT a bypass actor, so pin the correct credentials, not just the
+    //    generic token action.
+    expect(workflow).toContain("actions/create-github-app-token");
+    expect(workflow).toContain("secrets.BOT_APP_CLIENT_ID");
+    expect(workflow).toContain("secrets.BOT_APP_PRIVATE_KEY");
+    // 3. The manifest push goes through the explicit tokenized URL with that bot token, so it
+    //    authenticates as the bypass actor rather than the checkout's default credential.
+    expect(workflow).toContain("x-access-token:${BOT_TOKEN}");
+  });
+
   it("[P2] keeps PR and merge queue CI separated by hot/full validation mode", async () => {
     const workflow = await readFile(ciWorkflowPath, "utf8");
     const scopes = sectionBetween(workflow, "  scopes:", "  static_gate:");