Skip to content

Use GitHub API for pushes by default and require explicit github-token when using custom tokens #692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Andarist merged 26 commits into from
Aug 3, 2026
Merged

Use GitHub API for pushes by default and require explicit github-token when using custom tokens #692

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
fc08c33
Ensure `github-token` wins for `git-cli` pushes
Andarist Jul 6, 2026
0849cdf
more shenanigans
Andarist Jul 22, 2026
491b9ad
Merge remote-tracking branch 'origin/main' into fix/github-token-push
Andarist Jul 28, 2026
2a7a191
Default to GitHub API commit mode
Andarist Jul 28, 2026
f860b52
e2e auth tests
Andarist Jul 29, 2026
b81c97b
push missing utils
Andarist Jul 29, 2026
2ef83c7
rename input
Andarist Jul 29, 2026
6b3e3a7
refactor
Andarist Jul 29, 2026
60ca9a9
refactor
Andarist Jul 29, 2026
811eb9a
refactor
Andarist Jul 29, 2026
eb6788a
refactor
Andarist Jul 29, 2026
274708c
refactor
Andarist Jul 29, 2026
c8d942b
refactor
Andarist Jul 29, 2026
a834e17
reuse helpers
Andarist Jul 29, 2026
8e4ec1e
refactor
Andarist Jul 29, 2026
9ac84a7
refactor
Andarist Jul 29, 2026
008f900
simplify
Andarist Jul 29, 2026
33a1f15
add tests
Andarist Jul 29, 2026
57b6b8d
refactor
Andarist Jul 29, 2026
99664fb
Merge remote-tracking branch 'origin/main' into fix/github-token-push
Andarist Aug 3, 2026
4e5a52d
improve comments
Andarist Aug 3, 2026
86f0bdd
shift helper
Andarist Aug 3, 2026
59ac098
add comments
Andarist Aug 3, 2026
f4cfd52
extract test helpers
Andarist Aug 3, 2026
387d206
update docs and changesets
Andarist Aug 3, 2026
cb7d7f0
update one thing
Andarist Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .changeset/brave-pandas-commit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
"@changesets/action": major
---

Release commits and tags are now pushed using the GitHub API by default.

Replace the `commit-mode` input with the boolean `push-with-git-cli` input. Set `push-with-git-cli: true` to continue using the Git CLI.

Regardless of the push mode, custom GitHub tokens must be passed explicitly through the `github-token` input. The `GITHUB_TOKEN` environment variable and credentials configured by `actions/checkout` or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, `github-token` takes precedence over those repository credentials.
34 changes: 22 additions & 12 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,22 +36,32 @@ If using [trusted publishing](https://docs.npmjs.com/trusted-publishers), it's r
> [!TIP]
> Check out [the docs](https://changesets.dev/guide/automating#how-do-i-run-the-version-and-publish-commands) to learn how to set up the version and publish workflow.

> [!IMPORTANT]
> To use a custom GitHub token, pass it explicitly through the `github-token` input:
>
> ```yaml
> with:
> github-token: ${{ secrets.CUSTOM_GITHUB_TOKEN }}
> ```
>
> Setting the `GITHUB_TOKEN` environment variable does not configure the action. This applies whether release changes are pushed using the GitHub API or the Git CLI.

### API

<!-- api-start -->

| Inputs | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. |
| `publish-script` | The command to use to build and publish packages |
| `version-script` | The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided |
| `commit-message` | The commit message. Default to `Version Packages` |
| `pr-title` | The pull request title. Default to `Version Packages` |
| `pr-draft` | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them. |
| `pr-base-branch` | Sets the base branch of the PR. Defaults to `github.ref_name`. |
| `create-github-releases` | Whether to create Github releases after publish |
| `push-git-tags` | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`. |
| `commit-mode` | An enum to specify the commit mode. Use "git-cli" to push changes using the Git CLI, or "github-api" to push changes via the GitHub API. When using "github-api", all commits and tags are signed using GitHub's GPG key and attributed to the user or app who owns the GITHUB_TOKEN. |
| Inputs | Description |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input. |
| `publish-script` | The command to use to build and publish packages |
| `version-script` | The command to update version, edit CHANGELOG, read and delete changesets. Default to `changeset version` if not provided |
| `commit-message` | The commit message. Default to `Version Packages` |
| `pr-title` | The pull request title. Default to `Version Packages` |
| `pr-draft` | Controls draft PR behavior. Use 'create' to create new version PRs as draft, or 'always' to also convert existing version PRs back to draft when updating them. |
| `pr-base-branch` | Sets the base branch of the PR. Defaults to `github.ref_name`. |
| `create-github-releases` | Whether to create Github releases after publish |
| `push-git-tags` | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`. |
| `push-with-git-cli` | Whether to use the Git CLI instead of the GitHub API to push release commits and tags. Defaults to `false`. When using the GitHub API, commits and tags are signed using GitHub's GPG key and attributed to the user or app that owns the `github-token`. |

| Outputs | Description |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
Expand Down
15 changes: 8 additions & 7 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ runs:
main: "dist/index.js"
inputs:
github-token:
description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
description: >
The GitHub token to use for authentication. Defaults to the GitHub-provided token.
To use a custom token, pass it explicitly to this input.
required: false
default: ${{ github.token }}
publish-script:
Expand Down Expand Up @@ -38,14 +40,13 @@ inputs:
this option will also always be `true`.
required: false
default: true
commit-mode:
push-with-git-cli:
description: >
An enum to specify the commit mode. Use "git-cli" to push changes using the Git CLI,
or "github-api" to push changes via the GitHub API. When using "github-api",
all commits and tags are signed using GitHub's GPG key and attributed to the user
or app who owns the GITHUB_TOKEN.
Whether to use the Git CLI instead of the GitHub API to push release commits and tags.
Defaults to `false`. When using the GitHub API, commits and tags are signed using
GitHub's GPG key and attributed to the user or app that owns the `github-token`.
required: false
default: "git-cli"
default: false
outputs:
published:
description: A "true" or "false" string value to indicate whether a publishing is happened or not
Expand Down
2 changes: 1 addition & 1 deletion pr-comment/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ jobs:

| Inputs | Description |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input. |
| `body` | **Required.** The comment body to post on the PR. |
| `update-id` | By default, the action will create and update a comment with this id. Pass a different id to create and update a new comment, or pass an empty string to disable updating comments. |

Expand Down
4 changes: 3 additions & 1 deletion pr-comment/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ runs:
main: ../dist/pr-comment.js
inputs:
github-token:
description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
description: >
The GitHub token to use for authentication. Defaults to the GitHub-provided token.
To use a custom token, pass it explicitly to this input.
required: false
default: ${{ github.token }}
body:
Expand Down
14 changes: 7 additions & 7 deletions publish/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,13 @@ This action publishes packages to npm.

<!-- api-start -->

| Inputs | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. |
| `script` | The command to use to publish packages |
| `pack-dir-artifact-id` | Artifact id for packed publish output generated by the pack subaction |
| `create-github-releases` | Whether to create Github releases after publish |
| `push-git-tags` | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`. |
| Inputs | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `github-token` | The GitHub token to use for authentication. Defaults to the GitHub-provided token. To use a custom token, pass it explicitly to this input. |
| `script` | The command to use to publish packages |
| `pack-dir-artifact-id` | Artifact id for packed publish output generated by the pack subaction |
| `create-github-releases` | Whether to create Github releases after publish |
| `push-git-tags` | Whether to create git tags after publish. If `create-github-releases` is set to `true`, this option will also always be `true`. |

| Outputs | Description |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
Expand Down
4 changes: 3 additions & 1 deletion publish/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ runs:
main: ../dist/publish.js
inputs:
github-token:
description: "The GitHub token to use for authentication. Defaults to the GitHub-provided token."
description: >
The GitHub token to use for authentication. Defaults to the GitHub-provided token.
To use a custom token, pass it explicitly to this input.
required: false
default: ${{ github.token }}
script:
Expand Down
Loading
Loading