From e14c305aa9c75b112fc779bf9003101e37d2085a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nick=20J=C3=BCttner?= <nick@giantswarm.io>
Date: Thu, 6 Aug 2026 13:41:10 +0200
Subject: [PATCH 1/2] Let repos define the release PR body

Release PRs were created with an empty body. Repos whose CI is triggered from the PR body,
such as Tekton reading '/run cluster-test-suites', therefore never ran their tests on a
release PR unless someone remembered to comment - and provider chart releases were being
merged with no E2E run at all.

If a repo ships .github/release-pr-body.md its contents are used as the body. Repos
without the file keep an empty body.
---
 .github/workflows/create-release-pr.yaml | 15 ++++++++++++++-
 CHANGELOG.md                             |  6 ++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index a46421e..7004c7d 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -300,4 +300,17 @@ jobs:
           base: "${{ needs.gather_facts.outputs.base }}"
           version: "${{ needs.gather_facts.outputs.version }}"
         run: |
-          gh pr create --assignee ${{ github.actor }} --title "chore(release): v${{ env.version }}" --body "" --base ${{ env.base }} --head "${{ needs.gather_facts.outputs.branch }}"
+          # A repo can ship a release PR body in .github/release-pr-body.md. It is used
+          # verbatim, so a repo whose CI is triggered from the PR body - e.g. Tekton's
+          # `/run cluster-test-suites` - gets its tests run on the release PR without
+          # anyone having to remember to comment. Repos without the file keep an empty
+          # body, as before.
+          body_file=".github/release-pr-body.md"
+          if [ -f "${body_file}" ]; then
+            echo "Using release PR body from ${body_file}"
+            body="$(cat "${body_file}")"
+          else
+            body=""
+          fi
+
+          gh pr create --assignee ${{ github.actor }} --title "chore(release): v${{ env.version }}" --body "${body}" --base ${{ env.base }} --head "${{ needs.gather_facts.outputs.branch }}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed4e4c3..4cd8fe8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-08-06
+
+### Added
+
+- `create-release-pr`: Use `.github/release-pr-body.md` as the release PR body when a repo ships that file. Release PRs were created with an empty body, so repos whose CI is triggered from the PR body - such as Tekton's `/run cluster-test-suites` - never ran their tests on a release PR unless someone remembered to comment. Repos without the file keep an empty body. Towards https://github.com/giantswarm/roadmap/issues/4334
+
 ## 2026-08-05
 
 ### Fixed

From ccd9837c3a0e73bbeb374ff08c81e26c66fd0080 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nick=20J=C3=BCttner?= <nick@giantswarm.io>
Date: Thu, 6 Aug 2026 13:56:35 +0200
Subject: [PATCH 2/2] Pass PR values through the environment, not template
 expansion

zizmor flags the gh pr create line for code injection via template expansion: github.actor,
the base, branch and version were interpolated into the script before it ran. They now
come from the step environment as shell variables, which is also quoted correctly.
---
 .github/workflows/create-release-pr.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index 7004c7d..2adee0a 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -297,7 +297,9 @@ jobs:
       - name: Create PR
         env:
           GITHUB_TOKEN: "${{ secrets.TAYLORBOT_GITHUB_ACTION }}"
+          actor: "${{ github.actor }}"
           base: "${{ needs.gather_facts.outputs.base }}"
+          branch: "${{ needs.gather_facts.outputs.branch }}"
           version: "${{ needs.gather_facts.outputs.version }}"
         run: |
           # A repo can ship a release PR body in .github/release-pr-body.md. It is used
@@ -313,4 +315,11 @@ jobs:
             body=""
           fi
 
-          gh pr create --assignee ${{ github.actor }} --title "chore(release): v${{ env.version }}" --body "${body}" --base ${{ env.base }} --head "${{ needs.gather_facts.outputs.branch }}"
+          # Values come from the step environment rather than template expansions, which
+          # would be interpolated into the script before it runs.
+          gh pr create \
+            --assignee "${actor}" \
+            --title "chore(release): v${version}" \
+            --body "${body}" \
+            --base "${base}" \
+            --head "${branch}"