fix(ci): use PAT token for dev release pushes

- align dev-release workflow with protected-branch bypass used by release.yml - add a workflow regression test so checkout and release auth do not drift back to github.token
2026-07-16 08:17:11 +00:00 · 2026-04-20 14:56:25 -04:00
parent 65463f18db
commit 06fffd3025
2 changed files with 41 additions and 6 deletions
@@ -0,0 +1,34 @@
+import { describe, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+function resolvePath(relativePath: string) {
+  return path.resolve(import.meta.dir, relativePath);
+}
+
+describe('dev release workflow', () => {
+  test('uses PAT_TOKEN for protected dev branch release pushes', () => {
+    const workflowPath = resolvePath('../../../../.github/workflows/dev-release.yml');
+
+    expect(fs.existsSync(workflowPath)).toBe(true);
+
+    const workflow = fs.readFileSync(workflowPath, 'utf8');
+    const checkoutSection = workflow.slice(
+      workflow.indexOf('- name: Checkout'),
+      workflow.indexOf('- name: Setup Bun')
+    );
+    const releaseSection = workflow.slice(
+      workflow.indexOf('- name: Release'),
+      workflow.indexOf('- name: Notify Discord')
+    );
+
+    expect(workflow).toContain('name: Dev Release');
+    expect(workflow).toContain('branches: [dev]');
+    expect(checkoutSection).toContain("token: ${{ secrets.PAT_TOKEN }}");
+    expect(checkoutSection).not.toContain('token: ${{ github.token }}');
+    expect(releaseSection).toContain('GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}');
+    expect(releaseSection).toContain('GH_TOKEN: ${{ secrets.PAT_TOKEN }}');
+    expect(releaseSection).not.toContain('GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}');
+    expect(releaseSection).not.toContain('GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}');
+  });
+});