From 020debf940066d358c443e62330128c938ff7442 Mon Sep 17 00:00:00 2001 From: forkwright Date: Tue, 25 Aug 2026 11:53:41 -0500 Subject: [PATCH] ci: call the fleet release-please workflow instead of hardcoding the action Every release-please PR in this repo is held pending manual approval. A GitHub platform policy in force since 2026-06-11 gates any workflow run triggered by a PR authored via the default GITHUB_TOKEN -- the github-actions[bot] identity -- same-repo PRs included, with no repository or organization setting to disable it. Measured on a blocked run elsewhere in the fleet: jobs.total_count is 0, so no workflow condition ever evaluates. The fix is a token that is not GITHUB_TOKEN, and the fleet reusable already carries it. This repo hardcoded the action instead, one of twelve copies of something published centrally and correctly. The secret is passed explicitly by name rather than by `secrets: inherit`, which would forward every repository secret to a workflow in another repo for no capability gain. Safe to land before the secret exists: an undefined secret resolves to an empty string, which is falsy, so the reusable's fallback preserves today's behaviour until it is provisioned. Pinned @main, not by SHA. forkwright/.github publishes no tags, so a SHA pin there is one dependabot cannot bump -- which is how a consumer elsewhere froze on a revision predating a fix while its own comment claimed otherwise. Triggers, permissions, concurrency and any downstream attestation job stay in the caller, unchanged and unnormalised; the attestation job still resolves because the reusable keeps the same job id and output names. `timeout-minutes` does not survive: it cannot be set on a job that calls a reusable workflow. release-please runs well under a minute, so the practical cost is that a hung run reaches GitHub's default rather than being cut at ten. --- .github/workflows/release-please.yml | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index d7f24ea..2907c16 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -17,19 +17,9 @@ permissions: jobs: release-please: - runs-on: ubuntu-latest - timeout-minutes: 10 - outputs: - release_created: ${{ steps.release.outputs.release_created }} - tag_name: ${{ steps.release.outputs.tag_name }} - steps: - - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 - id: release - with: - config-file: release-please-config.json - manifest-file: .release-please-manifest.json - env: - GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} + uses: forkwright/.github/.github/workflows/release-please.yml@main + secrets: + RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }} attest-release-source: needs: [release-please]