From da1300c97ece4bc3dbd569cf0fad69ebdc3bb2b9 Mon Sep 17 00:00:00 2001 From: Jose Armesto Date: Mon, 1 Jun 2026 16:36:59 +0200 Subject: [PATCH] feat: pass release-please-approver secrets through in gen workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generated release-please.yaml now forwards two new optional secrets, RELEASE_PLEASE_APPROVER_CLIENT_ID and RELEASE_PLEASE_APPROVER_PRIVATE_KEY, to giantswarm/github-workflows/.github/workflows/release.yaml. These back the dedicated release-please-approver App that satisfies branch protection's required-approval rule on release-please PRs — without the auto-approve step, --auto --squash never completes the merge because the App-authored PR has no approving reviewer. Both secrets are required: false in the reusable workflow, so repos that don't have the App installed or the secrets configured see no behavior change. The auto-approve step is gated on the secrets being non-empty. The release-please-approver App needs Pull requests: Read and write AND Contents: Read and write — Contents: Read alone is silently disregarded by branch protection (empirically verified during testing on giantswarm/test-release-please). --- CHANGELOG.md | 4 ++++ .../workflows/internal/file/release_please.yaml.template | 2 ++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c42c7f55c..f0976f570 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ## [Unreleased] +### Changed + +- `gen workflows` (`--release-workflow=release-please`): generated `release-please.yaml` now passes `RELEASE_PLEASE_APPROVER_CLIENT_ID` and `RELEASE_PLEASE_APPROVER_PRIVATE_KEY` through to the reusable `release.yaml` workflow. These back the dedicated `release-please-approver` GitHub App that satisfies branch protection's required-approval rule on release-please PRs, so `--auto --squash` can complete the merge once required checks pass. The two new secrets are `required: false` upstream — repos that don't have the App installed or the org secrets configured see no behavior change. Requires the `release-please-approver` App to be installed with `Pull requests: Read and write` AND `Contents: Read and write` permissions (Contents: Read alone is silently disregarded by branch protection — empirically verified). + ## [8.0.0] - 2026-06-01 ### Added diff --git a/pkg/gen/input/workflows/internal/file/release_please.yaml.template b/pkg/gen/input/workflows/internal/file/release_please.yaml.template index ad3d4b65f..ef3327d6e 100644 --- a/pkg/gen/input/workflows/internal/file/release_please.yaml.template +++ b/pkg/gen/input/workflows/internal/file/release_please.yaml.template @@ -20,3 +20,5 @@ jobs: secrets: RELEASE_PLEASE_CLIENT_ID: ${{ secrets.RELEASE_PLEASE_CLIENT_ID }} RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} + RELEASE_PLEASE_APPROVER_CLIENT_ID: ${{ secrets.RELEASE_PLEASE_APPROVER_CLIENT_ID }} + RELEASE_PLEASE_APPROVER_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_APPROVER_PRIVATE_KEY }}