From 0a8e319c215c2ef0b9b2962430e72a3c76cd119e Mon Sep 17 00:00:00 2001 From: Edgar Arakelyan <247231060+earakely-scale@users.noreply.github.com> Date: Thu, 24 Sep 2026 16:49:20 -0700 Subject: [PATCH] ci: keep the release token out of the push URL The release bump passes its GitHub App token through a credential helper instead of embedding it in the remote URL, so it can't appear in logs. The URL keeps the user name so that CircleCI checkout's https-to-ssh rewrite doesn't match it. Co-Authored-By: Claude Opus 5.5 (1M context) --- scripts/circleci_release_bump.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/circleci_release_bump.sh b/scripts/circleci_release_bump.sh index 1bccc59c..13389a08 100755 --- a/scripts/circleci_release_bump.sh +++ b/scripts/circleci_release_bump.sh @@ -15,12 +15,16 @@ set -euo pipefail : "${CIRCLE_PROJECT_USERNAME:?CIRCLE_PROJECT_USERNAME must be set}" : "${CIRCLE_PROJECT_REPONAME:?CIRCLE_PROJECT_REPONAME must be set}" -REMOTE="https://x-access-token:${GH_TOKEN}@github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git" +REMOTE="https://x-access-token@github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git" MAIN_REF="refs/remotes/release/main" MAX_ATTEMPTS=3 git config user.name "${GH_APP_BOT_NAME}" git config user.email "${GH_APP_BOT_EMAIL}" +# The token reaches git through a credential helper that reads it from the environment at +# push time, so it is never part of a URL that git or this script could print. The user name +# stays in the URL so CircleCI checkout's global https-to-ssh insteadOf rewrite does not match. +git config credential.helper '!f() { echo username=x-access-token; echo "password=${GH_TOKEN}"; }; f' pip install --quiet tomlkit