Hi,

First of all, thank you for the work in changesets !

I would like to suggest avoiding personal access token to access github pull request informations, and we do not use github action to publish packages.

Actually changelog-github uses only a GITHUB_TOKEN, but in an organization environment, using a personal access token seems weird (I do not want my colleague using my token).

github handle applications for that, and I did create a github app with the same scopes as the personal token ones.

Once we have an application, and we did install this application on an organization, getting a token is done like this:

import fs from 'node:fs';
import { getInfo } from '@changesets/get-github-info';

const appId = …;
const installationId = …;
const privateKey = fs.readFileSync('./path-to-private-key.pem', 'utf8');


const app = new App({ appId, privateKey });

const { data: { token } } = await app.octokit.request(
  'POST /app/installations/{installation_id}/access_tokens',
  { installation_id: installationId }
);

We can then call the actual getInfo method:

process.env.GITHUB_TOKEN = token;

// console.log(token);

const infos = await getInfo({
  commit,
  repo,
});

console.log(info); 

//  user: 'someuser',
//  pull: 1,
//  links: {
//    commit: '[`comitid`](https://github.com/mapado/front/commit/comitid)',
//    pull: '[#1](https://github.com/mapado/orga/repo/1)',
//    user: '[@someuser](https://github.com/someuser)'
// }

Making this change request to add three environment variables:

• appId
• installationId
• privateKey

This way we do generate a one-time token for the organization.

I can implement that feature if you want.

Thanks