diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d46746a..24db1ac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,8 +6,13 @@ on: # Note: release-please uses GITHUB_TOKEN, which doesn't trigger other workflows. # CI/CodeQL checks on release PRs are handled by release-pr-checks.yml using -# pull_request_target. Docker publishing is handled by docker-publish.yml using -# workflow_run on this workflow (to detect when a release is created). +# pull_request_target. The close/reopen step below ensures the `reopened` event +# fires reliably (force-push `synchronize` events are inconsistent with GITHUB_TOKEN). +# Docker publishing is handled by docker-publish.yml using workflow_run. +# +# Ideal fix: use a fine-grained PAT (repo secret RELEASE_TOKEN) with contents:write +# and pull-requests:write. This makes release-please PRs trigger normal pull_request +# events, eliminating the need for release-pr-checks.yml entirely. permissions: contents: write @@ -16,9 +21,32 @@ permissions: jobs: release-please: runs-on: ubuntu-latest + outputs: + pr: ${{ steps.rp.outputs.pr }} + release_created: ${{ steps.rp.outputs.release_created }} steps: - name: Run release-please + id: rp uses: googleapis/release-please-action@v4 with: config-file: release-please-config.json manifest-file: .release-please-manifest.json + + # When release-please creates or updates a PR via GITHUB_TOKEN, the + # pull_request_target `synchronize` event doesn't always fire. Closing + # and reopening the PR ensures the `reopened` event triggers CI checks. + trigger-pr-checks: + needs: [release-please] + if: needs.release-please.outputs.pr != '' && needs.release-please.outputs.release_created != 'true' + runs-on: ubuntu-latest + steps: + - name: Close and reopen release PR to trigger checks + env: + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ fromJSON(needs.release-please.outputs.pr).number }} + run: | + echo "Triggering checks on release PR #$PR_NUMBER" + gh pr close "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" + sleep 2 + gh pr reopen "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" + echo "Release PR #$PR_NUMBER reopened — checks should now trigger"