Merge pull request #251 from wellcomecollection/Give-release-action-p…

…ermissions-to-push-to-main

Give release action permissions to push to main

.github/workflows/release.yml

@@ -38,22 +38,41 @@ jobs:
     if: needs.check-for-release-file.outputs.has-release == 'true'
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Update CHANGELOG.md and build.sbt
         run: |
           git fetch --tags
           LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1))
           python3 .github/scripts/create_release.py ${LATEST_TAG} $(pwd)
-      - name: Commit and push changes
+
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: 129326 # App ID of the Wellcome Collection app
+          private-key: ${{ secrets.WELLCOME_COLLECTION_APP_PRIVATE_KEY }}
+
+      - name: Configure git
+        # We need to give the GitHub action full repo privileges via a PAT so that it can push the release directly into main
         run: |
-          NEW_TAG=$(cat CHANGELOG.md | grep -m1 -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+')
           git config --global user.name "GitHub on behalf of Wellcome Collection"
           git config --global user.email "[email protected]"
+          
+          git remote set-url origin https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/${{ github.repository }}.git
+
+      - name: Commit and push changes
+        run: |
           git checkout main
           git pull
+          
           git add CHANGELOG.md build.sbt
           git rm RELEASE.md
+          
+          NEW_TAG=$(cat CHANGELOG.md | grep -m1 -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+')
           git commit -m "$(printf "Release: Bump version to ${NEW_TAG}\n\n[skip ci]")"
           git tag ${NEW_TAG}
+
           git push origin main
           git push origin --tags