From 0ba732b153cdfba07ff1528e0001a4179fa741e7 Mon Sep 17 00:00:00 2001
From: david morales <118213696+davidmoralesz@users.noreply.github.com>
Date: Sat, 10 Oct 2026 08:00:16 -0600
Subject: [PATCH] fix(templates): pass the release app from the release-mod
 starter

A caller made from the starter opened its release pull request with GITHUB_TOKEN, so the
required checks never ran on it. The starter now passes the release app's client ID and
key, and lists installing the app among the steps before a first release. The README's
caller example matches, and notes that a private repository needs its own copies.
---
 README.md                          |  7 ++++++-
 workflow-templates/release-mod.yml | 15 ++++++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index fe2ff39..3ab879d 100644
--- a/README.md
+++ b/README.md
@@ -158,6 +158,10 @@ jobs:
       contents: write
       pull-requests: write
     uses: studiobimo/.github/.github/workflows/release-please.yml@v1
+    with:
+      app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+    secrets:
+      app-private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
   publish:
     needs: release
@@ -238,7 +242,8 @@ as a GitHub App so the checks run:
    write** and **Pull requests: read and write**, no webhook, and install it on the repositories
    that release with release-please.
 2. Store its client ID as the organization variable `RELEASE_APP_CLIENT_ID` and a private key as
-   the organization secret `RELEASE_APP_PRIVATE_KEY`.
+   the organization secret `RELEASE_APP_PRIVATE_KEY`. On the Free plan those reach public
+   repositories only, so a private one needs both added to the repository itself.
 3. Pass both from the caller:
 
    ```yaml
diff --git a/workflow-templates/release-mod.yml b/workflow-templates/release-mod.yml
index 3d3ebeb..ab56524 100644
--- a/workflow-templates/release-mod.yml
+++ b/workflow-templates/release-mod.yml
@@ -12,6 +12,8 @@ name: Release
 # a tag created with GITHUB_TOKEN does not trigger another workflow. GitHub suppresses
 # that to stop runaway loops, and it would silently mean a release that never publishes.
 # Chaining on `needs` and the `release-created` output is what makes the handoff reliable.
+# It stays the handoff with the release app too: a tag made by the app does trigger other
+# workflows, so a second publisher on `push: tags` or `release` would ship twice.
 #
 # The publish job holds your Modrinth and CurseForge tokens and runs this repo's own
 # Gradle build. That is safe here and only here: this workflow triggers on a push to the
@@ -21,7 +23,12 @@ name: Release
 # Before the first real release:
 #   1. Add release-please-config.json and .release-please-manifest.json to this repo.
 #   2. Add MODRINTH_TOKEN and CURSEFORGE_TOKEN as repository secrets.
-#   3. Make sure your build actually has the publish task (mod-publish-plugin's
+#   3. Install the studio's release app on this repo (organization settings -> GitHub
+#      Apps -> the app -> Install App). A public repo then gets RELEASE_APP_CLIENT_ID and
+#      RELEASE_APP_PRIVATE_KEY from the organization. A private repo does not, on the Free
+#      plan: add both to the repo itself, as a variable and a secret. Until they resolve,
+#      release-please falls back to GITHUB_TOKEN and the release pull request gets no checks.
+#   4. Make sure your build actually has the publish task (mod-publish-plugin's
 #      `publishMods`). Until it does, set `dry-run: true` below: the jars still get
 #      built, attested and attached to the run, but nothing is pushed to a download page.
 
@@ -41,6 +48,12 @@ jobs:
       contents: write
       pull-requests: write
     uses: studiobimo/.github/.github/workflows/release-please.yml@v1
+    # As the release app, not GITHUB_TOKEN: a pull request opened with GITHUB_TOKEN
+    # triggers no workflows, so the release pull request's required checks would never run.
+    with:
+      app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+    secrets:
+      app-private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
   publish:
     needs: release