Instead of using the protected-branch plugin, we use a short-lived installation access token from a newly created + installed Neurobagel Bot app (which has been added to the list of actors allowed to bypass required PRs) to authenticate at both the actions/checkout and release steps
note: the choice to use the bot is somewhat arbitrary, this should also work with a PAT from an org admin, but this way the release comments are not associated with any specific account and can be clearly differentiated as automated, e.g.:
Checklist
This section is for the PR reviewer
[x] PR has an interpretable title with a prefix ([ENH], [FIX], [REF], [TST], [CI], [MNT], [INF], [MODEL], [DOC]) (see our Contributing Guidelines for more info)
[ ] PR links to GitHub issue with mention Closes #XXXX
[ ] Tests pass
[x] Checks pass
For new features:
[ ] Tests have been added
For bug fixes:
[ ] There is at least one test that would fail under the original bug conditions.
Changes proposed in this pull request:
protected-branchplugin, we use a short-lived installation access token from a newly created + installed Neurobagel Bot app (which has been added to the list of actors allowed to bypass required PRs) to authenticate at both theactions/checkoutand release stepsChecklist
This section is for the PR reviewer
[ENH],[FIX],[REF],[TST],[CI],[MNT],[INF],[MODEL],[DOC]) (see our Contributing Guidelines for more info)Closes #XXXXFor new features:
For bug fixes: