From e08a33d9ea273dc18877743f71f59d64bfc3dfb5 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Thu, 2 Jul 2026 15:41:25 +0200 Subject: [PATCH] fix(ci): enable release-PR auto-merge with the PAT, not GITHUB_TOKEN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Auto-merge enabled via GITHUB_TOKEN attributes the eventual merge commit to github-actions[bot], so recursion prevention suppresses the resulting push to main — the follow-up release-please run that cuts the tag/release never fires. Net: the version PR merges but no release/tag/images are ever produced (#719). Enable auto-merge with RELEASE_PLEASE_TOKEN instead (a real identity) so the merge triggers the tag-cutting run. Approval stays on GITHUB_TOKEN because it must be a different identity than the PR author (the PAT) to count as a review. Observed on #723: merged 3.77.3-beta.0 but no run followed and no tag was cut. --- .github/workflows/release-please-beta.yml | 8 +++++++- .github/workflows/release-please.yml | 5 ++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-please-beta.yml b/.github/workflows/release-please-beta.yml index 9e1187da..9bfbb6aa 100644 --- a/.github/workflows/release-please-beta.yml +++ b/.github/workflows/release-please-beta.yml @@ -51,8 +51,14 @@ jobs: fi pr=$(gh pr list --head release-please--branches--main --state open --json number --jq '.[0].number // empty') if [ -n "$pr" ]; then + # Approve as github-actions[bot] (GITHUB_TOKEN) — a different identity + # than the PR author (the PAT) — so it counts as a valid review. gh pr review "$pr" --approve --body "Automated approval — release-please version bump + changelog (#719)." || true - gh pr merge "$pr" --squash --auto || true + # Enable auto-merge as the PAT so the eventual merge commit is + # attributed to a real identity. If enabled via GITHUB_TOKEN the merge + # push is suppressed by recursion prevention and the follow-up run that + # cuts the tag/release never fires (#719). + GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto || true else echo "No open release PR to auto-merge." fi diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index eb33b723..91b977a4 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -44,8 +44,11 @@ jobs: fi pr=$(gh pr list --head release-please--branches--stable --state open --json number --jq '.[0].number // empty') if [ -n "$pr" ]; then + # Approve as github-actions[bot] (GITHUB_TOKEN, ≠ the PAT author) so it + # is a valid review; enable auto-merge as the PAT so the merge commit is + # attributed to a real identity and triggers the tag-cutting run (#719). gh pr review "$pr" --approve --body "Automated approval — release-please version bump + changelog (#719)." || true - gh pr merge "$pr" --squash --auto || true + GH_TOKEN="$RELEASE_PAT" gh pr merge "$pr" --squash --auto || true else echo "No open release PR to auto-merge." fi