actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-11-10 17:10:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

release: push tags with the release deploy key (enables tag-ruleset enforcement) (#1650)

Browse Source 
* release: push tags with the release deploy key

So the tag ruleset (terraform-config#81310) can be enforced: GITHUB_TOKEN can never bypass a ruleset, a deploy key can. No change to how releases are cut.

* release: SHA-pin actions/checkout in the deploy-key jobs

The checkout steps now hold the ruleset-bypass deploy key, so resolve actions/checkout by full SHA (v6.0.2, same pin as sync-base-action.yml) rather than the mutable v6 tag.
This commit is contained in:
Chris Norman
2026-11-06 14:21:18 -05:00
committed by GitHub
parent 61a9c274fa
commit 115e0b2c49
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+16 -2
View File
@@ -32,9 +32,16 @@ jobs:
next_version: ${{ steps.next_version.outputs.next_version }}
steps:
- name: Checkout code
uses: actions/checkout@v6
# SHA-pinned (same pin as sync-base-action.yml): this step is handed
# the ruleset-bypass deploy key, so it must not resolve a mutable tag.
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
# Tag pushes below authenticate as the release deploy key (a
# bypass actor on the "Protect release tags" ruleset) instead of
# GITHUB_TOKEN, which can never bypass a ruleset. The key lives
# only in the main-restricted `production` environment.
ssh-key: ${{ secrets.RELEASE_TAG_DEPLOY_KEY }}
- name: Get latest tag
id: get_latest_tag
@@ -105,9 +112,16 @@ jobs:
contents: write
steps:
- name: Checkout code
uses: actions/checkout@v6
# SHA-pinned (same pin as sync-base-action.yml): this step is handed
# the ruleset-bypass deploy key, so it must not resolve a mutable tag.
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
# Tag pushes below authenticate as the release deploy key (a
# bypass actor on the "Protect release tags" ruleset) instead of
# GITHUB_TOKEN, which can never bypass a ruleset. The key lives
# only in the main-restricted `production` environment.
ssh-key: ${{ secrets.RELEASE_TAG_DEPLOY_KEY }}
- name: Update major version tag
run: |