ci: call the fleet release-please workflow instead of hardcoding the action

[forkwright]

Finding

Every release-please PR in this repo is permanently stuck, and the cause is not in this repo's workflow logic.

A GitHub platform policy in force since 2026-06-11 ("Bot-created pull requests can run workflows if approved") holds any workflow run triggered by a PR authored via the default GITHUB_TOKEN — the github-actions[bot] identity — pending manual approval. This includes same-repo PRs, not only forks.

Evidence

A blocked run on harmonia#733 (32795920085):

conclusion       = action_required
actor            = github-actions[bot]
triggering_actor = github-actions[bot]
jobs.total_count = 0

Zero jobs are ever created, so no workflow if: condition evaluates. All five workflows on the PR went action_required simultaneously.

The discriminating case: aletheia's release run looks clean, but its triggering_actor is forkwright — a human approval, not a differing configuration. There is no exempt setup to copy.

Probed for an opt-out: actions/permissions/access returns 404 "only applies to internal and private repositories" on public repos; the private-repo controls that do exist govern cross-repo access, PR creation and token scope, none of which gate run execution.

The fix

Run release-please under a token that is not GITHUB_TOKEN. The fleet reusable already does:

token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}

This repo hardcoded googleapis/release-please-action with no token: input at all — one of four copies of a thing the fleet already publishes, correctly, one repo away.

Why this is safe to land before the secret exists

An undefined repository secret resolves to an empty string, which is falsy, so the reusable's || fallback preserves today's behaviour exactly. Provisioning RELEASE_PLEASE_TOKEN then unblocks every migrated repo at once, with no further edits.

Decisions made deliberately

secrets: inherit not used. The reusable declares RELEASE_PLEASE_TOKEN by name in its workflow_call.secrets block, so it is passed by name. inherit forwards every repository secret to a workflow hosted in another repo, for no capability gain.

Pinned @main, not by SHA. forkwright/.github publishes no tags, so a SHA pin there is one nothing can bump — akroasis froze exactly that way on a revision predating a fix.

Everything repo-specific is carried over verbatim — trigger, permissions block, concurrency (including this repo's own cancel-in-progress choice), and any downstream attestation job. Those jobs' needs.release-please.outputs.* references still resolve, because the reusable's job id and output names match.

One thing does not survive

timeout-minutes cannot be set on a job that calls a reusable workflow (GitHub rejects it: Unexpected value 'timeout-minutes'). A hung run now falls back to GitHub's 360-minute default instead of being killed at 10. Fixing that means adding a timeout inside the reusable's own job definition, which is not this repo's to change.

Related

typikon was deliberately not migrated: its release-please job passes skip-github-release: true as part of a gated publication design, and the reusable has no input for it. Migrating would have silently started creating real GitHub Releases on every push.