Function withReleaseToken

packages/bumpy/src/core/github-release.ts:21–39

* Run an async function with BUMPY_GH_TOKEN as GH_TOKEN if available. * * GitHub releases created with the default GITHUB_TOKEN won't trigger * downstream workflows. Using BUMPY_GH_TOKEN (a PAT or App token) * allows `release` events to fire follow-up workflows. * * Any errors are scrubbed so

(fn: () => Promise<T>)

 * Any errors are scrubbed so the token never appears in CI logs.
 */
async function withReleaseToken<T>(fn: () => Promise<T>): Promise<T> {
  const token = process.env.BUMPY_GH_TOKEN;
  if (!token) return fn();
  const original = process.env.GH_TOKEN;
  process.env.GH_TOKEN = token;
  try {
    return await fn();
  } catch (err) {
    // Redact token from error messages to prevent leakage in CI logs
    const msg = err instanceof Error ? err.message : String(err);
    throw new Error(msg.replaceAll(token, '***'));
  } finally {
    if (original !== undefined) {
      process.env.GH_TOKEN = original;
    } else {
      delete process.env.GH_TOKEN;
    }
  }
}

export interface GitHubReleaseOptions {
  dryRun?: boolean;