fix(ci): add persist-credentials: false to release checkout#690
fix(ci): add persist-credentials: false to release checkout#690
Conversation
Ensure Changesets action uses PAT for git push so that CI triggers on the Version Packages PR. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
📝 WalkthroughSummary by CodeRabbit
WalkthroughUpdated the GitHub Actions release workflow to set Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
stackflow-docs | 4c513d2 | Commit Preview URL | Mar 31 2026, 07:23 AM |
Deploying stackflow-demo with
|
| Latest commit: |
4c513d2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8f124c39.stackflow-demo.pages.dev |
| Branch Preview URL: | https://edward-karrot-fix-release-ci.stackflow-demo.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Line 23: The pull_request path sets persist-credentials: false which prevents
git auth for the script step that runs scripts/publish-preview-packages.sh
(which calls git fetch, git show-ref, git diff); update the checkout/script step
to explicitly provide credentials by adding GITHUB_TOKEN: ${{
secrets.DAANGNBOT_PAT }} (or another appropriate token) to the environment for
the step that invokes scripts/publish-preview-packages.sh, or split into
separate jobs so the checkout for the script run uses persist-credentials: true
while keeping other paths unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: de2dd51d-2b97-4062-a829-63fdb3bbab53
📒 Files selected for processing (1)
.github/workflows/release.yml
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check repository visibility
echo "=== Repository Visibility ==="
gh repo view daangn/stackflow --json visibility --jq '.visibility'
echo -e "\n=== Checking recent workflow runs for pull_request events ==="
gh run list --workflow=release.yml --event=pull_request --limit 5 --json databaseId,conclusion,headBranch,event,createdAt --jq '.[] | "\(.databaseId) \(.event) \(.conclusion) \(.headBranch) \(.createdAt)"'
echo -e "\n=== Checking for failures in publish-preview-packages.sh step ==="
gh run list --workflow=release.yml --event=pull_request --limit 5 --json databaseId,conclusion | \
jq -r '.[] | select(.conclusion != "success") | .databaseId' | \
while read run_id; do
echo "Checking run $run_id:"
gh run view "$run_id" --log 2>/dev/null | grep -A5 "publish-preview-packages.sh" || echo " (no relevant logs found)"
doneRepository: daangn/stackflow
Length of output: 623
🏁 Script executed:
# First, let's examine the release.yml file completely
cat -n .github/workflows/release.ymlRepository: daangn/stackflow
Length of output: 3098
🏁 Script executed:
# Check if scripts/publish-preview-packages.sh exists and examine it
cat -n scripts/publish-preview-packages.shRepository: daangn/stackflow
Length of output: 2154
Provide explicit authentication credentials for the pull_request workflow path.
Setting persist-credentials: false correctly fixes the Changesets CI trigger issue for push events (line 71), but the pull_request workflow path (line 81-82) will fail because the script requires git authentication that is not provided.
The script scripts/publish-preview-packages.sh performs authenticated git operations:
- Line 11:
git fetch origin - Line 13:
git show-ref --verify --quiet refs/remotes/origin/"$BASE_BRANCH" - Line 21:
git diff --name-only origin/"$BASE_BRANCH"...HEAD
With persist-credentials: false and no explicit GITHUB_TOKEN passed to the script, these operations will fail, particularly for private repositories. The Changesets action (line 77) explicitly provides GITHUB_TOKEN: ${{ secrets.DAANGNBOT_PAT }}, but the script step (line 82) receives no credentials.
Fix: Add GITHUB_TOKEN to the script step:
Recommended solution
- name: Continuous release via pkg.pr.new
if: github.event_name == 'pull_request'
run: ./scripts/publish-preview-packages.sh ${{ github.event.pull_request.base.ref }}
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}Alternatively, split into separate jobs with different checkout configurations if you need more granular control over credentials per workflow path.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/release.yml at line 23, The pull_request path sets
persist-credentials: false which prevents git auth for the script step that runs
scripts/publish-preview-packages.sh (which calls git fetch, git show-ref, git
diff); update the checkout/script step to explicitly provide credentials by
adding GITHUB_TOKEN: ${{ secrets.DAANGNBOT_PAT }} (or another appropriate token)
to the environment for the step that invokes
scripts/publish-preview-packages.sh, or split into separate jobs so the checkout
for the script run uses persist-credentials: true while keeping other paths
unchanged.
1 participant
Summary
persist-credentials: falseto theactions/checkoutstep in the release workflowProblem
The Version Packages PR created by the Changesets action does not trigger CI. Manually closing and reopening the PR is required as a workaround.
Root cause:
actions/checkout@v4persistsgithub.tokenas anAuthorizationheader in git'shttp.extraheaderconfig. When the Changesets action later force-pushes the release branch, git uses this header (highest priority) instead of the PAT written to~/.netrc. Sincegithub.tokenis used for the push, GitHub's anti-loop policy prevents workflow triggers.Authentication priority:
http.extraheaderactions/checkoutcredential.helper.netrcFix
Setting
persist-credentials: falsepreventsactions/checkoutfrom persisting thegithub.tokenheader. The Changesets action's PAT (via.netrc) is then used for the force push, which triggers CI as expected.Test plan
mainand verify the Version Packages PR has CI checks running without manual close/reopen🤖 Generated with Claude Code