From cc6c460abb6e7e425f81b67fc983f891e034e4bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kim=20Harjam=C3=A4ki?= Date: Mon, 13 Jul 2026 09:19:33 +0300 Subject: [PATCH 1/2] fix(release): support optional PAT for release-please PR creation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause of all-repo Release Please failures: the default GITHUB_TOKEN cannot create pull requests when a repository's Settings > Actions > General > Workflow permissions > "Allow GitHub Actions to create and approve pull requests" toggle is disabled. release-please-action fails atomically with: ##[error]release-please failed: GitHub Actions is not permitted to create or approve pull requests. Because this happens inside the single manifest run, the already-merged release commit's tag/GitHub Release is never created either — hence 'gh release list' returning empty even after 'chore(main): release 1.0.0' PRs were merged. The repeated 'commit could not be parsed' messages for merge-commit and free-text subjects are pre-existing, non-fatal release-please warnings (excluded from the changelog by design) — not the cause of failure. Confirmed via API on autogen, .github, and cas-platform: can_approve_pull_request_reviews: false This adds an optional 'release-please-token' secret input to the reusable workflow, passed through to the action as 'token:', falling back to github.token when unset. This lets callers opt into a scoped PAT / GitHub App installation token (which is not subject to the Actions PR-creation restriction) without requiring the broader, org-wide 'Allow Actions to create/approve PRs' setting to be enabled. Backward compatible: no behavior change for existing pinned callers until they (a) repin to a commit that includes this fix and (b) pass a token via 'secrets: release-please-token' or 'secrets: inherit'. --- .github/workflows/release-please-reusable.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml index 5f4f965..5e92929 100644 --- a/.github/workflows/release-please-reusable.yml +++ b/.github/workflows/release-please-reusable.yml @@ -1,6 +1,21 @@ name: Release Please (reusable) on: workflow_call: + secrets: + release-please-token: + description: > + Optional PAT / GitHub App installation token used to create the + release-please pull request and GitHub Release. Required when the + calling repository has "Allow GitHub Actions to create and approve + pull requests" disabled (Settings > Actions > General > Workflow + permissions) — the default GITHUB_TOKEN cannot open pull requests + in that case and release-please-action fails with: + "GitHub Actions is not permitted to create or approve pull + requests." + Falls back to the default GITHUB_TOKEN when unset, preserving + existing behavior for repos that already allow Actions to create + PRs. + required: false jobs: release-please: runs-on: ubuntu-latest @@ -12,5 +27,6 @@ jobs: steps: - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: + token: ${{ secrets.release-please-token || github.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json From c859d265075a471e34414ae7861d68e8dd8169d4 Mon Sep 17 00:00:00 2001 From: Kim Harjamaki Date: Mon, 13 Jul 2026 11:29:18 +0300 Subject: [PATCH 2/2] fix(release): pass PAT to release-please self-caller --- .github/workflows/release-please.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 2fd89b9..3a52652 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -10,3 +10,5 @@ jobs: pull-requests: write issues: write uses: ./.github/workflows/release-please-reusable.yml + secrets: + release-please-token: ${{ secrets.RELEASE_PLEASE_TOKEN }}