Fix release on main branch

[drodarie]

Because of the protection on the main branch the automatic release pipeline does not work. In short, the github bot is not allowed to push on main. https://github.com/orgs/community/discussions/13836

There are no clean solution but there are two workarounds:

• Create a fake github user with special permissions and use its token to bypass the protections https://stackoverflow.com/questions/69263843/how-to-push-to-protected-main-branches-in-a-github-action
• Create a github app for the dbbs organization with special permissions: https://github.com/orgs/community/discussions/25305#discussioncomment-8256560

I am not sure which one is the best option..

[Helveg]

The GitHub App seems like the more appropriate solution :) You can name it the Automatic Release Bot and add it to the bypass list.

[drodarie]

Ok I have a working solution (it was a tricky one), here are the changes I suggest that:

• we create an Github App on dbbs-lab which will have write permissions on bsb-core or any repository from the organization. This app should have a private key that we can use to access it.
• we install the app on bsb-core or all repos from dbbs-lab.
• we setup a variable and a secret which will store respectively the app id and its private key. The main question is do we store them at the organization level or repo level. If we choose at the repo level we have to save the private key somewhere if we need to re-use it.
• we change the branch protection rules on bsb-core: use rulesets instead of the default branches protection system (technically does the same but allow certain users and app to bypass rules).
• we use this app through the github actions to generate a token that will allow to push on main.

I struggled a lot but I finally have a working version on my test repo

[Helveg]

organization level or repo level

org level seems better?

we change the branch protection rules on bsb-core: use rulesets instead of the default branches protection system (technically does the same but allow certain users and app to bypass rules).

yea, they're a new feature from this year, switching is good :)

Seems like a good solution, let's do it.