From aa7d026f1f1afde414215d93c407c1d231797cbf Mon Sep 17 00:00:00 2001 From: Paullo9 Date: Thu, 29 Oct 2026 16:41:39 +0100 Subject: [PATCH] ci: release-please opens the Release PR with the org release app when set up A Release PR opened with GITHUB_TOKEN gets pull_request runs that wait for approval, and its tags start no workflows. With the org variable RELEASE_APP_CLIENT_ID and secret RELEASE_APP_KEY set, the job mints an app token instead; unset, it falls back to GITHUB_TOKEN and the CI dispatch as before. Done: Release PRs can run CI without a tap. Next: the app and its two org settings (Paul). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-please.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6476ff8..e15fc68 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -3,9 +3,12 @@ # Merging the Release PR writes the CHANGELOG entry and the manifest version; the next run tags the merge commit and # creates the GitHub release. Tags are bare versions (0.9.1), never moved. # -# A PR opened with GITHUB_TOKEN starts no workflows, so this job dispatches CI on the Release PR's branch: the required -# `test` check then reports on its head commit. Step env is evaluated even when `if` skips the step, so the PR JSON is -# read with jq rather than fromJSON (empty on a run with no Release PR). Needs "Allow GitHub Actions to create and approve pull requests". +# The org's release app opens the Release PR and pushes the tag (org variable RELEASE_APP_CLIENT_ID, org secret RELEASE_APP_KEY): +# a PR opened with GITHUB_TOKEN gets pull_request runs that wait for a maintainer's approval, and its tags start no +# workflows. With the app token CI runs on the Release PR like on any PR, and the tag runs the tag workflows. +# Without the app (variable unset) the job falls back to GITHUB_TOKEN and dispatches CI on the Release PR's branch. Step +# env is evaluated even when `if` skips the step, so the PR JSON is read with jq rather than fromJSON (empty on a run with +# no Release PR). Needs "Allow GitHub Actions to create and approve pull requests". name: release-please on: @@ -26,13 +29,20 @@ jobs: release-please: runs-on: ubuntu-latest steps: + - id: app + if: vars.RELEASE_APP_CLIENT_ID != '' + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ vars.RELEASE_APP_CLIENT_ID }} + private-key: ${{ secrets.RELEASE_APP_KEY }} - id: release uses: googleapis/release-please-action@v4 with: + token: ${{ steps.app.outputs.token || github.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json - name: Run CI on the Release PR - if: steps.release.outputs.pr + if: steps.release.outputs.pr && steps.app.outputs.token == '' run: gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$(jq -r .headBranchName <<<"$PR")" env: PR: ${{ steps.release.outputs.pr }}