Skip to content

fix(ci): wire sc-governed-write-auth for security gate bypass #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jacob-cloudy wants to merge 5 commits into
base: master
Choose a base branch
from
+117 −27
Open

fix(ci): wire sc-governed-write-auth for security gate bypass #106

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2915d08
fix(ci): wire sc-governed-write-auth for security gate bypass
jacob-cloudy Aug 3, 2026
e23480d
fix(ci): pin sc-governed-write-auth to current main SHA
jacob-cloudy Aug 3, 2026
1cab8a7
fix(ci): keep CI_TOKEN for semantic-release GitHub API calls
jacob-cloudy Aug 19, 2026
5539b2e
chore(ci): pin sc-governed-write-auth to main
jacob-cloudy Aug 19, 2026
3058d71
fix(ci): scope sc-governed-write to default-branch push steps
jacob-cloudy Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ on:

permissions:
id-token: write
contents: write
packages: read

jobs:
release:
Expand All @@ -28,7 +30,14 @@ jobs:
run: npm ci
- name: Build
run: make build
# Authenticate as sc-governed-write so the push bypasses the security gate.
# See https://eng-doc.soundcloud.org/security/security-gate/bypass-allowlist/
- name: Authenticate for governed default-branch push
id: sc-governed-write
uses: soundcloud/security-tooling/.github/actions/sc-governed-write-auth@2e4086b2fe93e68d074a8037d18f55a3f0ea78ce
with:
sc-governed-write-app-private-key: ${{ secrets.SC_GOVERNED_WRITE_APP_PRIVATE_KEY }}
- name: Release
env:
GH_TOKEN: ${{ secrets.CI_TOKEN }}
GH_TOKEN: ${{ steps.sc-governed-write.outputs.token }}

@jacob-cloudy jacob-cloudy Aug 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something we need to check is that the sc-governed-write token has the necessary permissions. Could someone please confirm?

Image

@jacob-cloudy jacob-cloudy Aug 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added sc-goverened-write to this repo's branch protection rule's bypass list. However, it would be preferable to migrate this rule to a ruleset (GH's new preferred way of protecting branches).

run: npm run semantic-release
Loading