[yordis]

• Releases run on short-lived TrogonStack Releaser tokens instead of a shared personal access token tied to one account.
• Once every repo has switched, the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be deleted.

---

Note

Medium Risk
Release automation now depends on GCP workload identity, Secret Manager, and GitHub App vars; misconfiguration could block releases or break token permissions.

Overview
The Release Please workflow no longer uses the org secret GH_PAT_RELEASE_PLEASE_ACTION. It now mints short-lived credentials via the TrogonStack Releaser GitHub App.

The job runs in the github-app-releaser environment, requests id-token: write, authenticates to Google Cloud with workload identity, loads the app private key from Secret Manager, and passes the resulting app token to release-please-action. Required repo/org configuration is expected via vars such as RELEASER_PROJECT_ID, RELEASER_WORKLOAD_IDENTITY_PROVIDER, RELEASER_PRIVATE_KEY_SECRET, and RELEASER_APP_CLIENT_ID.

^{Reviewed by Cursor Bugbot for commit 81de703. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Walkthrough

The release workflow now authenticates to Google Cloud, retrieves a GitHub App private key from Secret Manager, and creates a GitHub App token. Release Please uses this token instead of the GH_PAT_RELEASE_PLEASE_ACTION secret.

Changes

Release workflow authentication

Layer / File(s)	Summary
Configure authentication and token handoff .github/workflows/release-please.yml	The workflow grants OIDC token permission, assigns the job to the github-app-releaser environment, authenticates to Google Cloud, retrieves the app private key, and creates a token with contents, pull-request, and issue write permissions. Release Please receives the generated token.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · up to 81de7

The workflow replaces the shared PAT with a short-lived App token. No implementation failure is established; deployment still requires compatible Google trust settings and an App installation with the requested permissions.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: releases move from a shared personal access token to a TrogonStack Releaser identity. The raw summary confirms the release-please workflow now authenticates with a Git…
Description check		The description states the purpose of the change. Releases now use short-lived TrogonStack Releaser tokens instead of a shared personal access token tied to one account. It also says the org-wide GH_P…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: releases move from a shared personal access token to a TrogonStack Releaser identity. The raw summary confirms the release-please workflow now authenticates with a GitHub App token instead of GH_PAT_RELEASE_PLEASE_ACTION. The title is specific and matches the changeset. The 'chore(ci):' prefix is a conventional commit type and scope for a CI change.

Full details: Description check

Explanation

The description states the purpose of the change. Releases now use short-lived TrogonStack Releaser tokens instead of a shared personal access token tied to one account. It also says the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be deleted after every repository switches. This matches the workflow change in the raw summary, which replaces that secret with a GitHub App token.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the release queue,
Then fetches a key from clouds of blue.
An app token takes the place,
Of the old secret in the release race.
The tags hop out, neat as can be.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 0a90949f-a2be-4c45-a7c4-1ed592ce8c8f)

[coderabbitai]

Additional comments: 2

.github/workflows/release-please.yml: 2

35-41: Minor · Potential issue · Heavy lift

Unverified finding
We couldn't verify this from the code. It is shown for review, not as a verified issue.

The new token depends on a GitHub App installation with the requested repository permissions. If the app is not installed on this repository, or its installation lacks one of these permissions, the token step may fail rather than replace the PAT.

Its scheduled or triggered release job fails and no release PR or release is created.

This can occur when: A repository switches to this workflow before its GitHub App installation or permission update is complete.

---

18-18: Minor · Potential issue · Heavy lift

Unverified finding
We couldn't verify this from the code. It is shown for review, not as a verified issue.

Selecting github-app-releaser changes the job's GitHub OIDC context. If the configured Google workload identity provider accepts only the previous ref-based subject or conditions, the new environment-bound identity may be rejected.

Google Cloud authentication fails and releases cannot run.

This can occur when: The provider's attribute condition or IAM binding matches a ref-based OIDC subject but not this environment's subject.

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 846bd38a-b26f-4e34-8f63-d81975ecbae7

Commits

Reviewing files that changed from the base of the PR and between 8457613 and 81de703.

Files selected for processing: 1

• .github/workflows/release-please.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.