fix(ci): wire sc-governed-write-auth for security gate bypass - #106
Open
jacob-cloudy wants to merge 5 commits into
Open
fix(ci): wire sc-governed-write-auth for security gate bypass#106jacob-cloudy wants to merge 5 commits into
jacob-cloudy wants to merge 5 commits into
Conversation
semantic-release pushes version-bump commits directly to master; authenticate as sc-governed-write so the push is allowed once the org security gate is enabled on this repo. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
Co-authored-by: Cursor <cursoragent@cursor.com>
jacob-cloudy
commented
Aug 12, 2026
Comment on lines
+33
to
+42
| GH_TOKEN: ${{ secrets.CI_TOKEN }} | ||
| GH_TOKEN: ${{ steps.sc-governed-write.outputs.token }} |
Author
There was a problem hiding this comment.
Something we need to check is that the sc-governed-write token has the necessary permissions. Could someone please confirm?
jacob-cloudy
commented
Aug 12, 2026
Comment on lines
+33
to
+42
| GH_TOKEN: ${{ secrets.CI_TOKEN }} | ||
| GH_TOKEN: ${{ steps.sc-governed-write.outputs.token }} |
Author
There was a problem hiding this comment.
I've added sc-goverened-write to this repo's branch protection rule's bypass list. However, it would be preferable to migrate this rule to a ruleset (GH's new preferred way of protecting branches).
sc-governed-write-auth configures git credentials for the default-branch push only. CI_TOKEN remains GH_TOKEN so @semantic-release/github can create releases, comment on issues/PRs, and open failure issues. Co-authored-by: Cursor <cursoragent@cursor.com>
Use the composite action branch ref instead of a commit SHA so callers pick up security-tooling updates without manual bumps. Co-authored-by: Cursor <cursoragent@cursor.com>
Split semantic-release into prep (CI_TOKEN for npm OIDC and analysis), governed git push, and GitHub release creation so sc-governed-write-auth only configures credentials for the master push. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The release workflow runs
semantic-releaseafter CI passes.@semantic-release/gitpushes version-bump commits directly tomaster; once the org security gate is enabled, that push must authenticate assc-governed-write[bot].Problem
The initial wiring replaced
CI_TOKENentirely with the governed-write token.sc-governed-writeonly hascontents: write, but@semantic-release/githubalso needsissues: writefor failure reporting and issue/PR comments.Solution
Use both tokens with separate roles (eng-doc Pattern B):
sc-governed-write-authconfigures git credentials immediately before release, so@semantic-release/git's push tomasterbypasses the security gate.CI_TOKENstays asGH_TOKENfor@semantic-release/github(GitHub Releases, issue comments, failure issues).Adds
contents: writeandpackages: readpermissions required by the composite action.Related PRs
intervenein the security gate rollout and allowlist this workflow (must merge second, after ProdSec review).ProdSec setup (after security-tooling PR merges)
sc-governed-writeGitHub App on this repo.SC_GOVERNED_WRITE_APP_PRIVATE_KEYorg secret.Follow-ups
sc-governed-writeto the repo branch protection / ruleset bypass list (see PR comments).