From aec346e30d1ba860b08d2bafd752cdc4009af4d7 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Sun, 8 Nov 2026 01:57:01 -0500 Subject: [PATCH 1/2] chore(ci): release as the TrogonStack Releaser Short-lived Releaser tokens replace the shared personal access token, so the org-wide secret can be deleted. Signed-off-by: Yordis Prieto --- .github/workflows/release-please.yml | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 29eccf78e..ababdf7fc 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -10,16 +10,40 @@ permissions: contents: write issues: write pull-requests: write + id-token: write jobs: release-please: name: Release Please runs-on: ubuntu-latest + environment: github-app-releaser timeout-minutes: 10 steps: + - name: Google Cloud auth + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 + with: + workload_identity_provider: ${{ vars.RELEASER_WORKLOAD_IDENTITY_PROVIDER }} + + - name: Releaser key + id: releaser_key + uses: google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262 # v3.0.0 + with: + secrets: |- + private_key:${{ vars.RELEASER_PRIVATE_KEY_SECRET }} + + - name: Releaser token + id: releaser + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.RELEASER_APP_CLIENT_ID }} + private-key: ${{ steps.releaser_key.outputs.private_key }} + permission-contents: write + permission-pull-requests: write + permission-issues: write + - name: Create release pull request or release uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: - token: ${{ secrets.GH_PAT_RELEASE_PLEASE_ACTION }} + token: ${{ steps.releaser.outputs.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json From e4184140caff2a53fe7b9b692d5ad3af07cca4c3 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Sun, 8 Nov 2026 08:16:49 -0500 Subject: [PATCH 2/2] fix(ci): give the Releaser key step its project Without a project, the Google auth library looks it up in Cloud Resource Manager, which the federated identity cannot read, so the key read fails as permission denied. Signed-off-by: Yordis Prieto --- .github/workflows/release-please.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index ababdf7fc..7516f0502 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -22,6 +22,7 @@ jobs: - name: Google Cloud auth uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: + project_id: ${{ vars.RELEASER_PROJECT_ID }} workload_identity_provider: ${{ vars.RELEASER_WORKLOAD_IDENTITY_PROVIDER }} - name: Releaser key