Latest Results
ci: Migrate `swc-bot` credentials to the `swc-project-bot` GitHub App (#12665)
<!-- Note: CI script will automatically rebase your PR so please do not
rebase unless required -->
<!-- Thanks for submitting a pull request! Please provide enough
information so that others can review your pull request. -->
**Description:**
Several CI jobs authenticate as the `swc-bot` user account with
long-lived credentials. This PR moves those jobs to the
`swc-project-bot` GitHub App. Each job now mints a short-lived
installation token with `actions/create-github-app-token`. The token
requests only the permissions that the job needs.
| Workflow | Old credential | New token permissions |
| --- | --- | --- |
| `publish.yml` (`git-tag-nightly`, `git-tag-stable`) | `SWC_BOT_SSH` |
`contents: write` |
| `publish-crates-manual.yml` | `SWC_BOT_SSH` | `contents: write` |
| `stale.yml` | `GH_TOKEN` | `issues: write`, `actions: write` |
| `lock.yml` | `BOT_GH_TOKEN` | `issues: write`, `pull-requests: write`,
`discussions: write` |
Changes:
- Add the `.github/actions/configure-bot-git` composite action. It sets
the git identity to `<app-slug>[bot]` with the
`<id>+<app-slug>[bot]@users.noreply.github.com` noreply email. It
resolves the bot user ID at runtime, so commits keep the correct
attribution after the app is renamed. The action also rewrites
`git@github.com:` to HTTPS and authenticates the pushes with the
installation token. Because of this, `scripts/publish.sh` stays
unchanged and still works locally over SSH.
- `tag-git-release` now takes `token` and `app-slug` inputs instead of
`ssh-private-key`.
- Remove the static `SWC Bot` / `bot@swc.rs` `GIT_AUTHOR_*` and
`GIT_COMMITTER_*` env from `publish.yml` and
`publish-crates-manual.yml`. These variables would override the app
identity. Other workflows that make only local, unpushed commits keep
the old identity.
- `scripts/bisect/list-commits.sh` also skips commits by the app. It
matches the app by its user ID (`316843836`) in the author email, so the
match does not depend on the app name.
Pushes made with an app token trigger other workflows. The `chore:
Publish` push therefore still starts `publish-crates.yml`, the same as
with the SSH key.
Required setup before merge:
1. Add the `BOT_APP_CLIENT_ID` variable (`Iv23liX54KJa0KGDHt0g`) and the
`BOT_APP_PRIVATE_KEY` secret. You can add them at the organization
level, the same as `SWC_BOT_SSH` and `BOT_GH_TOKEN`.
2. Give the app the `issues: write`, `discussions: write`, and `actions:
write` permissions. The app currently has only `actions: read`,
`contents: write`, `metadata: read`, and `pull_requests: write`. Token
creation fails if a job requests a permission that the app does not
have.
3. Add the app (Integration `4590732`) as an exempt bypass actor to the
`Protect main - PR Required` ruleset, the same as `swc-bot`
(`99782286`). Without this, the release pushes to `main` are rejected.
After the migration, you can remove `SWC_BOT_SSH`, `GH_TOKEN`, and
`BOT_GH_TOKEN`.
Validation:
- `actionlint -shellcheck=` passed on all workflows.
- `zizmor` v1.25.2 (`--offline --min-confidence high --min-severity
medium`) on `.github/workflows` and `.github/actions` reported no
findings.
- I ran the `configure-bot-git` script in a temporary `HOME` with a real
token. It resolved `swc-project-bot[bot]` (`316843836`), and `git
ls-remote git@github.com:swc-project/swc.git` went over HTTPS with the
auth header.
- The workflows did not run end to end with the app token. That requires
the setup above.
**BREAKING CHANGE:**
None.
**Related issue (if exists):**
None.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Latest Branches
0%
kdy1/fix-compat-lowering-cycle 0%
-2%
wbinnssmith:fix/lazy-sourcemap-source-content © 2026 CodSpeed Technology