From 656e7c3f265839decad326fd916b2bdc0d155deb Mon Sep 17 00:00:00 2001 From: vincent de smet Date: Thu, 6 Aug 2026 17:25:00 +0700 Subject: [PATCH 1/3] fix(ci): mint the Go-publish token from the open-constructs-cdktn App MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Go release job authenticated with TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN, a user PAT that expired: GitHub 401s the push, headless git falls back to prompting, and the job dies with 'could not read Password for https://***@github.com'. Both the original run and a fresh rerun failed identically on v0.24.0-pre.95. Mint an installation token from the open-constructs-cdktn GitHub App (GH_APP_ID / GH_APP_PRIVATE_KEY repo secrets) instead, scoped to cdk-terrain-go — the repo publib-golang pushes to. Same pinned create-github-app-token@v2 the other workflows use. Closes #66. --- .github/workflows/release-publish.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 32f64427e..408a5f3b8 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -194,9 +194,22 @@ jobs: with: name: ${{ inputs.dist_artifact_name }} path: dist + # Minted fresh each run by the open-constructs-cdktn GitHub App, replacing + # the TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN user PAT that silently expired + # and failed every Go publish with git prompting for a password (#66). + # Scoped to the one repo publib-golang pushes to; expires after an hour, + # which comfortably outlives this job. + - name: Generate GitHub App token + id: go-app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 + with: + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: open-constructs + repositories: cdk-terrain-go - name: Release run: npx --no publib-golang env: - GITHUB_TOKEN: ${{ secrets.TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.go-app-token.outputs.token }} GIT_USER_NAME: "CDK Terrain Bot" GIT_USER_EMAIL: "gh-actions@cdktn.io" From 9abec380394e2e1f00100cfc3437d09f3ddc0388 Mon Sep 17 00:00:00 2001 From: vincent de smet Date: Thu, 6 Aug 2026 17:27:54 +0700 Subject: [PATCH 2/3] fix(ci): scope the Go-publish App token to contents:write zizmor's github-app audit: without a permission-* input the minted token inherits every permission the installation has. publib-golang only pushes commits and tags, so contents:write is the whole requirement. --- .github/workflows/release-publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 408a5f3b8..b7d69c428 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -207,6 +207,10 @@ jobs: private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} owner: open-constructs repositories: cdk-terrain-go + # Push access to the Go bindings repo is all publib-golang needs; + # without this the token inherits every permission the installation + # has (zizmor: github-app). + permission-contents: write - name: Release run: npx --no publib-golang env: From f35a4704678c68a576cb883ba1bb4b00414b9a53 Mon Sep 17 00:00:00 2001 From: vincent de smet Date: Thu, 6 Aug 2026 18:07:58 +0700 Subject: [PATCH 3/3] chore(ci): retire TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN from the workflow contract The reusable workflow still required the expired PAT, which would have kept it provisioned forever just to satisfy the interface. Declare the App credentials release_golang actually consumes instead; both callers use 'secrets: inherit', so the interface swap is transparent. --- .github/workflows/release-publish.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index b7d69c428..c79dc7a8a 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -30,7 +30,12 @@ on: required: true NUGET_API_KEY: required: true - TERRAFORM_CDK_GO_REPO_GITHUB_TOKEN: + # Credentials of the open-constructs-cdktn GitHub App; release_golang + # mints a per-run installation token from them. Callers pass these via + # `secrets: inherit`. + GH_APP_ID: + required: true + GH_APP_PRIVATE_KEY: required: true jobs: