ci(release): allow manual dispatch of Release Please - #159
Merged
Conversation
Re-running a previous workflow run replays that run's original context, so a secret rotated afterwards is never picked up. A manual trigger gives a fresh run without needing a new commit on main.
There was a problem hiding this comment.
🟢 Approval recommended
The change is a minimal, valid workflow trigger addition that aligns with the stated recovery need and does not alter release logic.
Pull request overview
Adds a manual trigger to the existing Release Please workflow so maintainers can start a fresh workflow run (with current secrets/context) after rotating RELEASE_PLEASE_TOKEN, avoiding reliance on rerunning an older, stale-context run.
Changes:
- Add
workflow_dispatchto.github/workflows/release-please.ymlfor manual execution. - Document why manual dispatch is needed (reruns replay the original run context, including secret availability).
File summaries
| File | Description |
|---|---|
| .github/workflows/release-please.yml | Adds workflow_dispatch to allow maintainers to trigger a fresh Release Please run after secret rotation. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release Please has failed on every push to
mainsince this morning withResource not accessible by personal access tokenon release creation, so v1.3.0 was never tagged or published despite the manifest reading 1.3.0.The token was not the cause. A temporary diagnostic workflow (removed in this PR) used the
RELEASE_PLEASE_TOKENsecret to call the exact endpoint release-please calls, and it succeeded three times: a draft release, a non-draft release that created a new tag, and av99.99.99release. All cleaned up afterwards. GitHub reported the endpoint acceptscontents=write, which the token has. Reading release-please 17.3.0's source confirms its payload matches what the diagnostic sent.What was actually wrong is that every retry re-ran the same original run, which was created before the secret was first set. A re-run replays that run's original context, so it never saw any of the rotated tokens.
workflow_dispatchto the Release Please workflow so a maintainer can trigger a genuinely fresh run after rotating a secretTest: CI only. Merging this pushes to
main, which itself triggers a fresh Release Please run.PR Review
Checklist
uv run pytest)uv run ruff check .)!in title andBREAKING CHANGE:in bodyReview Focus
main.Related