ci: call the fleet release-please workflow instead of hardcoding the action - #32
Merged
Conversation
…action Every release-please PR in this repo is held pending manual approval. A GitHub platform policy in force since 2026-06-11 gates any workflow run triggered by a PR authored via the default GITHUB_TOKEN -- the github-actions[bot] identity -- same-repo PRs included, with no repository or organization setting to disable it. Measured on a blocked run elsewhere in the fleet: jobs.total_count is 0, so no workflow condition ever evaluates. The fix is a token that is not GITHUB_TOKEN, and the fleet reusable already carries it. This repo hardcoded the action instead, one of twelve copies of something published centrally and correctly. The secret is passed explicitly by name rather than by `secrets: inherit`, which would forward every repository secret to a workflow in another repo for no capability gain. Safe to land before the secret exists: an undefined secret resolves to an empty string, which is falsy, so the reusable's fallback preserves today's behaviour until it is provisioned. Pinned @main, not by SHA. forkwright/.github publishes no tags, so a SHA pin there is one dependabot cannot bump -- which is how a consumer elsewhere froze on a revision predating a fix while its own comment claimed otherwise. Triggers, permissions, concurrency and any downstream attestation job stay in the caller, unchanged and unnormalised; the attestation job still resolves because the reusable keeps the same job id and output names. `timeout-minutes` does not survive: it cannot be set on a job that calls a reusable workflow. release-please runs well under a minute, so the practical cost is that a hung run reaches GitHub's default rather than being cut at ten.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
Every release-please PR in this repo is held pending manual approval, and the cause is not this repo's workflow logic.
A GitHub platform policy in force since 2026-06-11 ("Bot-created pull requests can run workflows if approved") gates any workflow run triggered by a PR authored via the default
GITHUB_TOKEN— thegithub-actions[bot]identity. This includes same-repo PRs, not only forks, and there is no repository or organization setting to disable it (probed:actions/permissions/access404s on public repos; the private-repo controls govern cross-repo access, PR creation and token scope, none of which gate run execution).Measured on a blocked run elsewhere in the fleet:
jobs.total_count = 0. No job is ever created, so no workflow condition evaluates.The fix
Run release-please under a token that is not
GITHUB_TOKEN. The fleet reusable already does:This repo hardcoded
googleapis/release-please-actioninstead — one of twelve copies of something the fleet publishes centrally and correctly (kanon#3653).Safe to land before the secret exists
An undefined repository secret resolves to an empty string, which is falsy, so the reusable's
||fallback preserves today's behaviour exactly. ProvisioningRELEASE_PLEASE_TOKENthen unblocks every migrated repo at once, with no further edits anywhere.Decisions made deliberately
secrets: inheritnot used. The secret is passed by name.inheritforwards every repository secret to a workflow hosted in another repo, for no capability gain.@main, not a SHA.forkwright/.githubpublishes no tags, so a SHA pin there is one dependabot cannot bump — which is how a consumer elsewhere froze on a revision predating a fix while its own comment asserted dependabot was maintaining it.cancel-in-progresschoice are preserved exactly as found, even where they differ from the rest of the fleet. Any downstream attestation job is carried over verbatim and still resolves, because the reusable keeps the same job id (release-please) and output names (release_created,tag_name).One thing does not survive
timeout-minutescannot be set on a job that calls a reusable workflow. release-please normally finishes in well under a minute, so the practical cost is that a hung run reaches GitHub's default instead of being cut at ten. Giving the reusable's own job a timeout would restore it fleet-wide.Part of kanon#3653. Verified: this repo used only the default
config-file/manifest-fileand no input the reusable cannot express.