Support protected-branch release tokens

README.md

@@ -116,6 +116,35 @@ jobs:
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
+#### Protected branches
+
+If your release workflow needs to push the version bump back to a protected
+branch, provide a token that is allowed to bypass that branch protection as
+`PVER_GITHUB_TOKEN`.
+
+```yml
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - run: npm ci
+      - run: pver release
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PVER_GITHUB_TOKEN: ${{ secrets.PVER_GITHUB_TOKEN }}
+```
+
+`PVER_GITHUB_TOKEN` takes precedence over `GITHUB_TOKEN`. Use a fine-grained PAT
+or GitHub App token with contents write access, then add that token's actor to
+the branch protection bypass list. `GITHUB_TOKEN` can still be used for normal
+branches where no bypass is required.
+
 ## Analysis
 
 Analysis has two steps. Getting the `current_version` and using the `transition_method` to

src/release/configure-origin.ts

@@ -1,26 +1,23 @@
 export const configureOrigin = async (git: any) => {
-  if (process.env.GITHUB_TOKEN) {
-    // This doesn't work- it's possible the checkout command needs to use the
-    // github token (in the workflow yaml)
-    const remote_url = await git.remote(["get-url", "origin"])
+  const githubToken = process.env.PVER_GITHUB_TOKEN ?? process.env.GITHUB_TOKEN
 
-    // if the remote is in the form of git@github.com:foo/bar.git, convert it to
-    // https://github.com/foo/bar.git
-    if (remote_url.includes("git@")) {
-      const new_url = remote_url!.replace("git@", "https://")
-      await git.removeRemote("origin")
-      await git.addRemote("origin", new_url)
-    }
+  if (!githubToken) return
 
-    if (!remote_url.includes("oauth2:")) {
-      const new_url = remote_url!
-        .replace(
-          "https://",
-          `https://oauth2:${process.env.GITHUB_TOKEN.trim()}@`
-        )
-        .replace(/\n/g, "")
-      await git.removeRemote("origin")
-      await git.addRemote("origin", new_url)
-    }
+  const remoteUrl = String(await git.remote(["get-url", "origin"])).trim()
+
+  if (!remoteUrl.includes("github.com")) return
+
+  const httpsRemoteUrl = remoteUrl
+    .replace(/^git@github\.com:/, "https://github.com/")
+    .replace(/^ssh:\/\/git@github\.com\//, "https://github.com/")
+    .replace(/^https:\/\/[^@/]+@github\.com\//, "https://github.com/")
+
+  const authenticatedRemoteUrl = httpsRemoteUrl.replace(
+    /^https:\/\/github\.com\//,
+    `https://x-access-token:${githubToken.trim()}@github.com/`
+  )
+
+  if (authenticatedRemoteUrl !== remoteUrl) {
+    await git.remote(["set-url", "origin", authenticatedRemoteUrl])
   }
 }