[unional]

Why

changesets/action opens the "Version Packages" PR with the built-in GITHUB_TOKEN. GitHub starts no workflows for events that token causes, so the PR gets no checks and sits blocked on the required code / all-checks. #60 fixed that with an optional GitHub App token, but that keeps a long-lived private key in org secrets. This replaces it with a secretless design.

workflow_dispatch is the one event GITHUB_TOKEN may trigger. After changesets/action opens or updates the PR (its PR-number output is set and published is not true), the release job runs gh workflow run "$CI_WORKFLOW" --ref changeset-release/<branch>. Check runs from that dispatch attach to the branch head under the GitHub Actions app, so they satisfy the required check by name.

Changes

• Revert fix(release): open the Version Packages PR with the repobuddy App token #60's App-token code: RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY secrets, HAS_RELEASE_APP, the create-github-app-token step, and the token fallbacks.

• Add a workflow_call input ci-workflow (default pull-request.yml) and the dispatch step. If the dispatch fails (the caller's CI has no workflow_dispatch:, or the caller did not grant actions: write), it emits a ::warning:: that names the fix and does not fail the release. The workflow does not declare actions: write itself: a called workflow cannot request a permission its caller did not grant, and existing callers grant only id-token, contents and pull-requests, so declaring it would fail their releases at startup.

• Document in the header that the caller must grant actions: write.

• Rewrite the header comments to explain the design.

• README: drop the secrets: lines from the caller examples, add actions: write to the permissions example, add the workflow_dispatch: adoption step, and replace the App-token rationale.

actionlint 1.7.7 (with shellcheck) passes. There was no NPM_TOKEN secret before #60, so there is none to keep.

Caller changes

• Grant actions: write to the job that calls the release workflow.
• Add workflow_dispatch: to the CI workflow's on: block.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 15bd0c9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.