From b8c098f0017989076b1ebce9dded2a34a53cce11 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Tue, 4 Aug 2026 12:32:12 -0700 Subject: [PATCH] Fix nightly release deployment tag permissions (#10383) The nightly release failed because the default `GITHUB_TOKEN` is a GitHub Actions App installation token without permission to create a tag that includes workflow changes. - Mint a short-lived installation token for `z3prover-ci-bot`. - Request only `contents: write` and `workflows: write`. - Use the App token for checkout credentials, tag deletion/push, and release deletion/creation. - Do not use `GH_AW_GITHUB_TOKEN`, a PAT, or another classic token. Repository setup: - `Z3_CI_APP_CLIENT_ID` is configured on `Z3Prover/z3`. - Add `Z3_CI_APP_PRIVATE_KEY` as an Actions repository secret. - Grant `z3prover-ci-bot` **Workflows: Read and write**, then approve the updated installation permissions for the Z3Prover organization. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com> Co-authored-by: Lev Nachmanson Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/nightly.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 95f31dd5c0..dd8c58bbbb 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -816,8 +816,21 @@ jobs: ] runs-on: ubuntu-latest steps: + - name: Mint z3prover-ci-bot token + id: app-token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ vars.Z3_CI_APP_CLIENT_ID }} + private-key: ${{ secrets.Z3_CI_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: z3 + permission-contents: write + permission-workflows: write + - name: Checkout code uses: actions/checkout@v7.0.1 + with: + token: ${{ steps.app-token.outputs.token }} - name: Download all artifacts uses: actions/download-artifact@v8.0.1 @@ -829,7 +842,7 @@ jobs: - name: Delete existing Nightly release and tag env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | if gh release view Nightly > /dev/null 2>&1; then # Delete the release and associated tag if it exists. @@ -848,7 +861,7 @@ jobs: - name: Create Nightly release env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | git tag -f Nightly "${{ github.sha }}" if ! git push --force origin refs/tags/Nightly; then