fix: Skip tx-builder dispatch and note token lifetime

Author: luqmanbello

.github/workflows/deployment.yml

@@ -140,6 +140,10 @@ jobs:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME_STAGING }}
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
 
+      # Minted here because composite-action steps cannot read secrets directly.
+      # Installation tokens live 60 minutes and the dispatch is the last nx target;
+      # historical release runs complete in 3-9 minutes, so expiry is not a
+      # practical concern.
       - name: Generate promotions repo token
         id: promotions_token
         continue-on-error: true

scripts/prepare_production_deployment.sh

@@ -8,6 +8,14 @@ if [ -n "$GH_TOKEN" ] && [ -n "$PROMOTIONS_REPO" ]
 then
   APP_NAME="$(basename $(pwd))"
   PACKAGE_VERSION=$(sed -nr 's/^\s*\"version": "([0-9]{1,}\.[0-9]{1,}.*)",$/\1/p' package.json)
+  # tx-builder promotes via safe-tx-builder-tf (built from safe-wallet-monorepo
+  # releases) since 2026-03; dispatching it here would only trip the promotion
+  # workflow's app guard.
+  if [ "$APP_NAME" = "tx-builder" ]
+  then
+    echo "Skipping tx-builder: it deploys via safe-tx-builder-tf"
+    exit 0
+  fi
   # --ref is required: without it gh resolves the default branch via GraphQL,
   # which the app token (actions:write, metadata:read only) is not allowed to do.
   # A failed dispatch must not fail this script: it runs mid nx-chain, before