Skip to content

chore(ci): use CI_BOT_GITHUB_TOKEN for releases - #3992

Merged
isekovanic merged 1 commit into
developfrom
chore/release-use-ci-bot-token
Nov 14, 2026
Merged

isekovanic merged 1 commit into
developfrom
chore/release-use-ci-bot-token

Conversation

@isekovanic

Copy link
Copy Markdown
Contributor

🎯 Goal

Run releases with the same bot token the rest of CI uses, so the repo needs one GitHub token instead of two.

Ticket: https://linear.app/stream/issue/RN-529

🛠 Implementation details

release.yml now reads CI_BOT_GITHUB_TOKEN (org secret) instead of STREAM_CI_GITHUB_BOT_TOKEN, in both places: the checkout used to push the release commit and tags, and GH_TOKEN for the GitHub release on main.

The token needs Contents read & write on this repo, plus Pull requests and Issues read & write for the release comments. STREAM_CI_GITHUB_BOT_TOKEN can be deleted once this is on both develop and main, since releases from main read main's copy of the workflow.

🎨 UI Changes

None.

🧪 Testing

CI only. The next release run on develop should get past semantic-release's git push --dry-run check.

☑️ Checklist

  • PR targets the develop branch

@isekovanic
isekovanic requested a review from oliverlaz November 14, 2026 00:37
@isekovanic
isekovanic merged commit 422b07d into develop Nov 14, 2026
15 of 17 checks passed
@isekovanic
isekovanic deleted the chore/release-use-ci-bot-token branch November 14, 2026 00:49
isekovanic added a commit that referenced this pull request Nov 14, 2026
…ibution changes from develop (#3993)

## 🎯 Goal

Bring the CI changes from `develop` to `v9-release`, so its release and
sample distribution workflows work with the current secrets and
variables.

Ports #3990, #3991 and #3992.

Ticket: https://linear.app/stream/issue/RN-529

## 🛠 Implementation details

- `examples/SampleApp/fastlane/Fastfile`: the `appstore_api_key` lane
uses key ID `8KCMZF773S` (#3990).
- `sample-distribution.yml`:
- iOS job: no longer passes `MATCH_GIT_BASIC_AUTHORIZATION`. `match`
clones over SSH (#3990).
- Android job: the S3 APK upload steps are removed (#3990), and
`ANDROID_FIREBASE_APP_ID` is read from the repository variable instead
of a secret (#3991).
- `release.yml`: uses `CI_BOT_GITHUB_TOKEN` instead of
`STREAM_CI_GITHUB_BOT_TOKEN` (#3992).

Applied to the `v9-release` versions of the files, so nothing else from
`develop` comes along.

## 🎨 UI Changes

None.

## 🧪 Testing

CI only. The next release run on `v9-release` should push and publish as
before.

## ☑️ Checklist

- [ ] PR targets the `develop` branch (targets `v9-release` on purpose)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant