feat: cut releases locally, without a GitHub App - #14
Merged
Conversation
Creating a GitHub App needs organization access, which not every maintainer has, and until now that made releases impossible rather than merely manual. `pnpm release:pr` and `pnpm release:tag` run exactly the same release-please against the maintainer's own `gh` login. Nothing is stored, no secret exists to leak, and because the pull request is authored by a person rather than by GitHub Actions it triggers `ci` — which a workflow-opened one does not, since GITHUB_TOKEN pull requests do not start workflows. So the local path is not a lesser fallback: on the check that matters it is better than the automated one. The App remains the upgrade for when someone has the access to create it, and release.yml is unchanged. The script refuses to run anywhere but main, checks gh is installed and logged in, and prints the next command at each step. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-27606 | rollup |
4.52.5 |
4.59.0 |
View full analysis in Upwind Console
Scan completed in 48s
Scan history (1 scan)
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
ffbdc31 < |
2026-08-17 01:39 UTC | +1 | 0 | +1 |
Last scanned: ffbdc31 · 2026-08-17 01:39 UTC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You do not need the GitHub App to ship. Creating one needs organization access, and until now that made releases impossible rather than merely manual — this removes the dependency.
It is the same tool, and on one axis it is better
scripts/release.shruns the samerelease-pleasethe workflow runs, against your ownghlogin. Nothing is stored and there is no secret to leak.More usefully: the pull request it opens is authored by you, so
ciruns on it. A pull request opened by GitHub Actions does not trigger workflows, so the automated path produces a release pull request that themainruleset can never see a greencion — the exact problem that made the App necessary in the first place. The local path does not have it.Verified against this repository with
--dry-run, and you already hold theadminrole the ruleset bypasses, so nothing blocks the merge either.Guards
main— "Releases come frommain, never from a branch" (MAINTAINERS.md).ghis installed and logged in, and says which is missing.shellcheckclean.The App is now an upgrade, not a prerequisite
release.ymlis unchanged and still does all of this automatically onceAUTOMATION_APP_IDexists. The checklist item is reworded from "nothing releases until this exists" to what is actually true: optional for releases, still required to automate dependency updates.biome ciclean · 380/380 tests · shellcheck clean · dry-run verified.🤖 Generated with Claude Code