Repository navigation
CI never runs on Release Please PRs, so every release needs a manual close and reopen #12
Description
Versions: python-library-template 8ebf45d, Copier 9.18.2
template/.github/workflows/release-please.yml:15-18 runs googleapis/release-please-action@v5 without token:, so github-actions[bot] opens and updates the release PR using GITHUB_TOKEN. GitHub creates the pull_request CI run for that event and then holds it. The run never gets a job, and it ends with "This workflow run required approval but was not approved before it expired." The ruleset from scripts/setup_repo.py requires All checks passed and has bypass_actors: [] (scripts/setup_repo.py:148-163), so nobody can merge the release PR until someone closes and reopens it, which starts a run as a person. All 14 libraries in the org that have release-please.yml use @v5 without token:, so every one of them has this problem.
Reproduction
gh api repos/bedrock-python/idempotency-kit/issues/38/timeline --paginate \
--jq '.[] | select(.event=="closed" or .event=="reopened" or .event=="merged") | "\(.event) \(.created_at) \(.actor.login)"'
for id in 34969119985 34969305398; do
gh api repos/bedrock-python/idempotency-kit/actions/runs/$id \
--jq '"\(.id) \(.conclusion) by=\(.triggering_actor.login) created=\(.created_at) ended=\(.updated_at)"'
gh api repos/bedrock-python/idempotency-kit/actions/runs/$id/jobs --jq '" jobs=\(.total_count)"'
done
gh api repos/bedrock-python/deadline-budget/actions/runs/33179620202 \
--jq '"\(.id) \(.conclusion) by=\(.triggering_actor.login) created=\(.created_at) ended=\(.updated_at) \(.display_title)"'The annotation is visible on the run page, for example https://github.com/bedrock-python/clientwright/actions/runs/34976706840.
Actual
idempotency-kit #38, "chore(master): release idempotency-kit 0.4.1":
closed 2026-09-15T12:30:58Z AlexeyShalaev
reopened 2026-09-15T12:31:00Z AlexeyShalaev
merged 2026-09-15T12:32:12Z AlexeyShalaev
closed 2026-09-15T12:32:12Z AlexeyShalaev
34969119985 failure by=github-actions[bot] created=2026-09-15T12:29:12Z ended=2026-09-15T12:30:59Z
jobs=0
34969305398 success by=AlexeyShalaev created=2026-09-15T12:31:02Z ended=2026-09-15T12:31:58Z
jobs=6
On the run page: "This workflow run required approval but was not approved before it expired." clientwright #40 and #43 and deadline-budget #23 follow the same pattern: a close and reopen two seconds apart, a bot run with 0 jobs, and a green run started by a person. When nobody closes and reopens in time, the held run waits for 30 days:
33179620202 failure by=github-actions[bot] created=2026-08-28T14:19:58Z ended=2026-09-27T14:21:51Z chore(master): release deadline-budget 0.1.1
Why
The release is the step this pipeline was built to automate, and right now it depends on a manual step that the template's docs never mention. Release Please also pushes to the open release PR after every merge to master, and each push creates a new held run. So the close and reopen has to happen after the last update, right before the merge.
Proposal
- Give Release Please a GitHub App token, using
actions/create-github-app-tokenandtoken: ${{ steps.app.outputs.token }}on the action, so its PR events start CI like anyone else's. One App at the org level covers every library, andsetup_repo.pycould check that its secrets exist. - If an App is not wanted, write the step down in
NEW_LIBRARY_CHECKLIST.mdandCONTRIBUTING.md. The step is to close and reopen the release PR right before merging, or to approve the held run from the PR. I have not checked whether approving works as a replacement for close and reopen.
Activity
AlexeyShalaev commentedon Oct 16, 2026
Plan: the release PR gets opened and updated with a GitHub App installation token, so its
pull_requestevents start CI like anyone else's.release-please.ymlmints the token withactions/create-github-app-token@v3, scoped tocontents,pull-requestsandissueswrite (Release Please labels its PRs), and passes it astoken:.RELEASE_PLEASE_APP_CLIENT_IDand an org secretRELEASE_PLEASE_APP_PRIVATE_KEY. While those are not set, the workflow falls back toGITHUB_TOKENand logs a warning saying so. A new library therefore still releases on its first day, the same way as today, rather than failing before the App is set up.setup_repo.pychecks that the repository can see both and prints a[WARN]with the fix when it can't.Rejected:
I can't test the App path end to end until the App exists in the org. What I can test in the PR is the YAML (actionlint) and both branches of the fallback expression.
AlexeyShalaev commentedon Oct 16, 2026
The fix is in #23. One change from the plan: the App token is scoped to
contentsandpull-requestswrite only, the same as theGITHUB_TOKENthat releases with today, soissues: writeis not needed. Before the App path does anything, the org needs the App plusRELEASE_PLEASE_APP_CLIENT_ID(variable) andRELEASE_PLEASE_APP_PRIVATE_KEY(secret), as described in the README section the PR adds. Until then the workflow behaves as today and warns.fix: CI runs on release PRs without a close and reopen
fix: CI runs on release PRs without a close and reopen
fix: CI runs on release PRs without a close and reopen (#23)