From c52c325f223e459a3145e6d6d624f9df33cbf10d Mon Sep 17 00:00:00 2001
From: Jon Bogaty <jon@jonbogaty.com>
Date: Mon, 27 Jul 2026 01:05:47 -0500
Subject: [PATCH] ci: dispatch required checks automatically on the release PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #56, which added workflow_dispatch to the required workflows so
a release-please PR could be unblocked. That made the checks *runnable* but
not automatic — someone still had to trigger them by hand, so a fresh
release PR (#59) came back with zero check runs and sat BLOCKED exactly as
before. A manual escape hatch is not a fix.

The Release job now dispatches `ci.yml` and `validate-packages.yml` against
the release branch immediately after release-please creates or updates its
PR, so the required contexts report without human intervention. Gated on
`prs_created` and parsing the branch from the action's `pr` output with jq
at runtime, so the step is skipped entirely on release-only runs and fails
loudly rather than silently dispatching a wrong ref.

Needs `actions: write` to dispatch, which is added narrowly to this workflow.
---
 .github/workflows/release.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b7e2a67..b1e4367 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,12 +8,38 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  actions: write # dispatch the required checks onto the release PR branch
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+      # `validate` and `build-site` are required status checks, but they only
+      # trigger on `pull_request`, and GitHub does not fire that event for PRs
+      # opened by GITHUB_TOKEN — which is how release-please opens this one.
+      # Without this the release PR reports zero checks and sits permanently
+      # BLOCKED. Dispatch both explicitly against the release branch so the
+      # required contexts actually report.
+      - name: Run required checks on the release PR
+        if: steps.release.outputs.prs_created == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          branch="$(printf '%s' "$RELEASE_PR" | jq -r '.headBranchName')"
+          if [ -z "$branch" ] || [ "$branch" = "null" ]; then
+            echo "::error::could not read headBranchName from release-please output"
+            exit 1
+          fi
+          for wf in ci.yml validate-packages.yml; do
+            echo "Dispatching $wf on $branch"
+            gh workflow run "$wf" --ref "$branch" --repo "$GITHUB_REPOSITORY"
+          done