[yordis]

• Releases run on short-lived TrogonStack Releaser tokens instead of a shared personal access token tied to one account.
• Once every repo has switched, the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be deleted.

---

Note

Medium Risk
Release automation now depends on GCP workload identity, Secret Manager, and GitHub App configuration; misconfiguration could block releases, though scope is limited to CI.

Overview
The Release Please workflow no longer uses the org secret GH_PAT_RELEASE_PLEASE_ACTION. It now runs in the github-app-releaser environment, adds id-token: write, and mints a short-lived GitHub App token for release-please.

New steps authenticate to Google Cloud via workload identity, load the releaser app private key from Secret Manager, and create a token with contents, PR, and issues write access. That token is passed into release-please-action instead of the PAT.

^{Reviewed by Cursor Bugbot for commit e418414. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: f6873f91-0a91-4a58-a6a7-b51c3c1fc890)

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a7cc2920-7654-4914-b163-595528f2aa29

Commits

Reviewing files that changed from the base of the PR and between 5076322 and e418414.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The release workflow now authenticates to Google Cloud through workload identity, retrieves a private key from Secret Manager, and creates a GitHub App token. The release action uses that token instead of the GH_PAT_RELEASE_PLEASE_ACTION secret.

Changes

Release workflow authentication

Layer / File(s)	Summary
Workload identity and release token .github/workflows/release-please.yml	The job requests the id-token: write permission and runs in the github-app-releaser environment. It retrieves a private key from Secret Manager, creates a GitHub App token with write permissions for contents, pull requests, and issues, and passes the token to the release action.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · previous review 50763

The workflow replaces the shared PAT with a GitHub App token. No actionable defect is established; it is mergeable subject to normal configuration validation.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: release automation now runs as the TrogonStack Releaser GitHub App instead of the shared personal access token. The changeset matches this. The title follows conventio…
Description check		The description states that releases now use short-lived TrogonStack Releaser tokens in place of a shared personal access token, and that the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be remove…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: release automation now runs as the TrogonStack Releaser GitHub App instead of the shared personal access token. The changeset matches this. The title follows conventional commit form and is specific enough for a teammate scanning history.

Full details: Description check

Explanation

The description states that releases now use short-lived TrogonStack Releaser tokens in place of a shared personal access token, and that the org-wide GH_PAT_RELEASE_PLEASE_ACTION secret can be removed afterward. The workflow change in the raw summary matches these points, so the description is related to the changeset.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit watched the workflow glow,
As cloud credentials began to flow.
A secret key came safely near,
A GitHub App token appeared.
The release hopped along its way,
While carrots marked the close of day.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d05aae71-d554-4913-9015-5beb1ef1ef79

Commits

Reviewing files that changed from the base of the PR and between 3c6160c and 5076322.

Files selected for processing: 1

• .github/workflows/release-please.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 6f50ee26-9a58-4970-ba8b-0d2003bd9d5c)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 541f3e84-0fca-4bd8-87c5-dd7755c51631)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 5fb4fe64-3cbe-4fb4-a0b5-47e807c36fc1)