revert: restore GITHUB_TOKEN for the release-please action - #287
Merged
Conversation
Reverts #285. Passing RELEASE_PLEASE_TOKEN to the action made the release PR authored by the same account that the approve step runs as, so `gh pr review --approve` failed with "Can not approve your own pull request" and the step aborted before enabling auto-merge. GITHUB_TOKEN on the action is deliberate: it makes the release PR authored by the bot, leaving RELEASE_PLEASE_TOKEN a distinct identity that is allowed to approve it. CI on the release PR is already triggered by the trigger-ci label, which ci.yml picks up via its `labeled` event type, so the token swap was not needed for that.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts #285, which broke the Release Please workflow on main.
What broke
Passing
RELEASE_PLEASE_TOKENtogoogleapis/release-please-actionmade the release PR authored by the same account the approve step runs as. GitHub rejects that:The step runs under
bash -e, so it aborted there and never reachedgh pr merge --auto. Release PR #286 is consequently open, CI-green, but unapproved and without auto-merge.Why GITHUB_TOKEN was correct
It is deliberate, and the two identities are the point:
RELEASE_PLEASE_TOKENthen approves it as a distinct identity, which GitHub permitsCI already triggers without the swap
ci.ymllistens forlabeledin itspull_requesttypes, and the release-please job adds atrigger-cilabel usingGH_TOKEN: RELEASE_PLEASE_TOKEN. Because that label is applied by a real user PAT rather thanGITHUB_TOKEN, the event fires normally. #286 shows this working:Build & Testran and passed.So the token swap solved a problem that the label mechanism had already solved, at the cost of breaking approval.
After this merges
#286 still needs a manual approve and merge to ship 1.5.8, since its auto-merge was never enabled. Subsequent releases should self-handle again.