[yordis]

• Releases run on short-lived TrogonStack Releaser tokens instead of a shared personal access token tied to one account.
• Once every repo has switched, the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be deleted.

---

Note

Medium Risk
Changes how release automation is authenticated and adds GCP Secret Manager access; misconfiguration could break releases or leak credentials.

Overview
The Release Please workflow no longer authenticates with the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret. It now runs in the github-app-releaser environment and mints a short-lived GitHub App token for release-please.

New steps use Google Cloud Workload Identity (id-token: write), fetch the app private key from Secret Manager, and call actions/create-github-app-token with contents/PR/issue write permissions before passing that token to release-please-action.

^{Reviewed by Cursor Bugbot for commit 5a66ae7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The release workflow now authenticates to Google Cloud, retrieves a configured GitHub App private key, and creates a GitHub App token. Release Please uses that token instead of the GH_PAT_RELEASE_PLEASE_ACTION secret.

Changes

Release workflow authentication

Layer / File(s)	Summary
Configure authentication and token use .github/workflows/release-please.yml	The job adds id-token: write permission and uses the github-app-releaser environment. It authenticates to Google Cloud, retrieves the configured private key, creates a GitHub App token with contents, pull-request, and issues write permissions, and passes the token to Release Please.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · up to 5a66a

The release workflow switches from a personal access token to a short-lived GitHub App token. No concrete merge-blocking risk was found in the supplied change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title "chore(ci): release as the TrogonStack Releaser" matches the main change. The release-please workflow now authenticates with a GitHub App token (TrogonStack Releaser) instead of the GH_PAT_R…
Description check		The description states that releases will use short-lived TrogonStack Releaser tokens instead of a shared personal access token. It also notes that the GH_PAT_RELEASE_PLEASE_ACTION secret can be delet…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "chore(ci): release as the TrogonStack Releaser" matches the main change. The release-please workflow now authenticates with a GitHub App token (TrogonStack Releaser) instead of the GH_PAT_RELEASE_PLEASE_ACTION personal access token. The title is specific, short, and uses a conventional commit prefix.

Full details: Description check

Explanation

The description states that releases will use short-lived TrogonStack Releaser tokens instead of a shared personal access token. It also notes that the GH_PAT_RELEASE_PLEASE_ACTION secret can be deleted after all repositories switch. Both points match the workflow change, which replaces that secret with a GitHub App token.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit hops past the release queue,
A cloud-signed key makes tokens new.
Release Please gets its granted pass,
While carrots wait beside the glass.
The workflow bounds ahead at last.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf921715-f71e-40c7-916e-26ebd8cf4ad5

Commits

Reviewing files that changed from the base of the PR and between 7da68a2 and 5a66ae7.

Files selected for processing: 1

• .github/workflows/release-please.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: c3a1e726-55dc-41e1-957e-2c2b703cc9ff)