From a3fda60d0002024d61edb12a72c9ba44cc7e4bd4 Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 3 Aug 2026 22:18:40 +0300 Subject: [PATCH 1/2] ci(release): resolve releaser bot user id at runtime Avoid hardcoding the bot numeric id so noreply commit emails stay linked if the App is recreated. --- .github/workflows/ci.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a5b95e9..d6b430b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,6 +71,19 @@ jobs: permission-contents: write permission-issues: write permission-pull-requests: write + - name: Resolve release bot identity + id: release-bot-identity + env: + GH_TOKEN: ${{ steps.release-bot.outputs.token }} + APP_SLUG: ${{ steps.release-bot.outputs.app-slug }} + run: | + set -euo pipefail + user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)" + if [[ ! "$user_id" =~ ^[0-9]+$ ]]; then + echo "failed to resolve numeric bot user id for ${APP_SLUG}[bot]" >&2 + exit 1 + fi + echo "user-id=${user_id}" >> "$GITHUB_OUTPUT" - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: @@ -108,9 +121,9 @@ jobs: env: GITHUB_TOKEN: ${{ steps.release-bot.outputs.token }} GIT_AUTHOR_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot] - GIT_AUTHOR_EMAIL: 283001373+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + GIT_AUTHOR_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com GIT_COMMITTER_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot] - GIT_COMMITTER_EMAIL: 283001373+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + GIT_COMMITTER_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com build-unix-binaries: if: needs.release.outputs.new_release_published == 'true' From 9c9de1fb6eb4f54306f1bf15ba72a6d96f0e8cb3 Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 3 Aug 2026 22:28:49 +0300 Subject: [PATCH 2/2] ci(release): harden runtime bot identity lookup Use an explicit bash shell, URL-encode the [bot] path segment, and emit user_id so Actions expressions do not treat the output name as subtraction. --- .github/workflows/ci.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6b430b..58dbde5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -73,17 +73,18 @@ jobs: permission-pull-requests: write - name: Resolve release bot identity id: release-bot-identity + shell: bash env: GH_TOKEN: ${{ steps.release-bot.outputs.token }} APP_SLUG: ${{ steps.release-bot.outputs.app-slug }} run: | set -euo pipefail - user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)" + user_id="$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq .id)" if [[ ! "$user_id" =~ ^[0-9]+$ ]]; then echo "failed to resolve numeric bot user id for ${APP_SLUG}[bot]" >&2 exit 1 fi - echo "user-id=${user_id}" >> "$GITHUB_OUTPUT" + echo "user_id=${user_id}" >> "$GITHUB_OUTPUT" - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: @@ -121,9 +122,9 @@ jobs: env: GITHUB_TOKEN: ${{ steps.release-bot.outputs.token }} GIT_AUTHOR_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot] - GIT_AUTHOR_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + GIT_AUTHOR_EMAIL: ${{ steps.release-bot-identity.outputs.user_id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com GIT_COMMITTER_NAME: ${{ steps.release-bot.outputs.app-slug }}[bot] - GIT_COMMITTER_EMAIL: ${{ steps.release-bot-identity.outputs.user-id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + GIT_COMMITTER_EMAIL: ${{ steps.release-bot-identity.outputs.user_id }}+${{ steps.release-bot.outputs.app-slug }}[bot]@users.noreply.github.com build-unix-binaries: if: needs.release.outputs.new_release_published == 'true' @@ -305,17 +306,18 @@ jobs: - name: Resolve Homebrew release bot user ID id: homebrew-release-bot-user + shell: bash env: GH_TOKEN: ${{ steps.homebrew-release-bot.outputs.token }} APP_SLUG: ${{ steps.homebrew-release-bot.outputs.app-slug }} run: | set -euo pipefail - user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)" + user_id="$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq .id)" if [[ ! "$user_id" =~ ^[0-9]+$ ]]; then echo "failed to resolve numeric bot user id for ${APP_SLUG}[bot]" >&2 exit 1 fi - echo "user-id=${user_id}" >> "$GITHUB_OUTPUT" + echo "user_id=${user_id}" >> "$GITHUB_OUTPUT" - name: Release to Homebrew tap uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3 @@ -324,7 +326,7 @@ jobs: homebrew_tap: homebrew-tap github_token: ${{ steps.homebrew-release-bot.outputs.token }} commit_owner: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot] - commit_email: ${{ steps.homebrew-release-bot-user.outputs.user-id }}+${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + commit_email: ${{ steps.homebrew-release-bot-user.outputs.user_id }}+${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com branch: main formula_folder: Formula install: 'bin.install "putio"'