From 8fb74afe92fc5cdf9a2bd1ffee22a777335eab19 Mon Sep 17 00:00:00 2001 From: forkwright Date: Tue, 25 Aug 2026 11:15:52 -0500 Subject: [PATCH] ci: call the fleet release-please workflow instead of hardcoding the action Every release-please PR in this repo is permanently stuck. A GitHub platform policy in force since 2026-06-11 holds any workflow run triggered by a PR authored via the default GITHUB_TOKEN -- the github-actions[bot] identity -- pending manual approval, same-repo PRs included. There is no repository or organization setting to disable it; that was probed and does not exist. Measured on a blocked run: jobs.total_count is 0, so no workflow condition ever evaluates. The fix is to run release-please under a token that is not GITHUB_TOKEN, and the fleet reusable already does exactly that: token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} This repo hardcoded the action instead, with no token input at all -- one of four copies of something the fleet already publishes correctly. The secret is passed explicitly rather than by `secrets: inherit`, because inherit forwards EVERY repository secret to a workflow hosted in another repo for no capability gain. The reusable declares this one by name. Safe to land before the secret exists: an undefined repo secret resolves to an empty string, which is falsy, so the reusable's fallback keeps today's behaviour until it is provisioned. Provisioning then lights up every migrated repo at once. Pinned @main, not by SHA. forkwright/.github publishes no tags, so a SHA pin there is one nothing can bump. One thing does not survive: `timeout-minutes` cannot be set on a job that calls a reusable workflow, so a hung run now falls back to GitHub's 360-minute default rather than being killed at 10. Fixing that means adding a timeout inside the reusable's own job, which is not this repo's to change. --- .github/workflows/release-please.yml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 8920fa8a..6cb80559 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -20,17 +20,9 @@ permissions: jobs: release-please: - runs-on: ubuntu-latest - timeout-minutes: 10 - outputs: - release_created: ${{ steps.release.outputs.release_created }} - tag_name: ${{ steps.release.outputs.tag_name }} - steps: - - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 - id: release - with: - config-file: release-please-config.json - manifest-file: .release-please-manifest.json + uses: forkwright/.github/.github/workflows/release-please.yml@main + secrets: + RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }} # WHY: SLSA provenance + signed SBOM for the release source archive at # release-creation time, per SUPPLY-CHAIN.md ยง Required per release. Binary