From 874811562cc25e102e16cacb3db80ef75a01d9ec Mon Sep 17 00:00:00 2001
From: Richard Knoll <riknoll@microsoft.com>
Date: Wed, 12 Aug 2026 11:03:03 -0700
Subject: [PATCH] update deploy workflow to use deploy keys

---
 .github/workflows/pxt-buildpush.yml | 31 ++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pxt-buildpush.yml b/.github/workflows/pxt-buildpush.yml
index 1cc2777e8e8..a48c08a05fc 100644
--- a/.github/workflows/pxt-buildpush.yml
+++ b/.github/workflows/pxt-buildpush.yml
@@ -93,8 +93,37 @@ jobs:
         env:
           CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
           PXT_ACCESS_TOKEN: ${{ secrets.PXT_ACCESS_TOKEN }}
-          PXT_RELEASE_REPO: ${{ secrets.PXT_RELEASE_REPO }}
           NPM_PUBLISH: true
           CHROME_BIN: chromium-browser
           DISPLAY: :99.0
           CI: true
+          PXT_SKIP_GIT_COMMIT: true
+
+      - name: Clone release repo
+        uses: actions/checkout@main
+        with:
+          repository: ${{ secrets.BUILT_REPO_NAME }}
+          path: tmp/releases/release
+          fetch-depth: 3
+          fetch-tags: true
+          ssh-key: ${{ secrets.BUILT_REPO_DEPLOY_KEY }}
+
+      - name: Read release info
+        id: release_info
+        run: |
+          tag=$(cat tmp/releases/release.json | jq -r '.tag')
+          url=$(cat tmp/releases/release.json | jq -r '.url')
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+
+      - name: Push artifacts to release repo
+        run: |
+          cp -a tmp/releases/built/. tmp/releases/release
+          cd tmp/releases/release
+          git config user.name "github-actions"
+          git config user.email "github-actions@users.noreply.github.com"
+          git add .
+          git commit -m "Release ${{steps.release_info.outputs.tag}} from ${{steps.release_info.outputs.url}}"
+          git tag ${{steps.release_info.outputs.tag}}
+          git push
+          git push --tags