From 6fe72bd59bcacd3ec8d286afb2d5212ef1cfd7cf Mon Sep 17 00:00:00 2001
From: TaprootFreak <142087526+TaprootFreak@users.noreply.github.com>
Date: Mon, 27 Jul 2026 09:37:10 +0200
Subject: [PATCH] Restore the Actions bot as the release PR author
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #4380 switched the `gh pr create` step in the Auto Release PR workflow from the
workflow's own GITHUB_TOKEN to a personal access token, and lowered the job
permission to `pull-requests: read`. Since then every release PR has carried a
person's name as its author instead of the Actions bot, and the automation has
depended on one account's credential lifetime.

Revert both lines in this workflow. The permission has to go back to `write`
because GITHUB_TOKEN needs it to open a PR; `gh pr list` in the earlier step is
covered by it.

The behavioural cost is documented at the call site rather than silently taken
back: a PR opened with GITHUB_TOKEN does not start a `pull_request` workflow run
for its `opened` activity, so the release PR opens without API PR CI, CodeQL
Advanced, PR Review Bot, and API Migration Check. Later pushes to `develop` do
start `synchronize` runs, so a release PR merged before any such push gets no
`pull_request` run at all, while one that stays open across further merges does.
This was measured on the bot-authored release PRs from before the PAT switch, not
inferred: one merged unchanged had no `pull_request` run, another got its runs
only once a later merge moved the head, and the PAT-created one got them four
seconds after creation.

The practical consequence for reviewers is in the comment too: a green release PR
does not imply CI ran with `main` as the target.

The guards PR #4380 removed from api-pr.yaml stay removed — restoring them would
also suppress the `synchronize` runs, which are the only release-PR CI left.
---
 .github/workflows/auto-release-pr.yaml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/auto-release-pr.yaml b/.github/workflows/auto-release-pr.yaml
index b5fb4b20be..bff1b322c8 100644
--- a/.github/workflows/auto-release-pr.yaml
+++ b/.github/workflows/auto-release-pr.yaml
@@ -7,7 +7,9 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
+  # `write` is required because the release PR is opened with the workflow's own
+  # GITHUB_TOKEN (see the create step) rather than with a personal access token.
+  pull-requests: write
 
 concurrency:
   group: auto-release-pr
@@ -47,7 +49,24 @@ jobs:
       - name: Create Release PR
         if: steps.check-pr.outputs.pr_exists == 'false' && steps.check-diff.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }}
+          # The release PR must be authored by the Actions bot, not by a person. A personal
+          # access token would put a human's name on an automated PR and tie the automation to
+          # one account's credential lifetime.
+          #
+          # Trade-off, deliberately accepted: a PR opened with GITHUB_TOKEN does not start a
+          # `pull_request` workflow run for the `opened` activity. The release PR therefore opens
+          # without any of them — API PR CI, CodeQL Advanced, PR Review Bot, and API Migration
+          # Check when the release carries non-seed `migration/**` changes. Later pushes to
+          # `develop` do start `synchronize` runs, so a release PR merged before any such push
+          # gets no `pull_request` run at all, while one that stays open across further merges
+          # does. Observed on the bot-authored release PRs before this was switched to a PAT:
+          # one merged unchanged had no `pull_request` run, another got its runs only once a
+          # later merge moved the head.
+          #
+          # Consequence for reviewers: a green release PR does NOT imply CI ran with `main` as
+          # the target. The checks shown may come solely from the push runs on `develop` for the
+          # same head commit.
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COMMIT_COUNT: ${{ steps.check-diff.outputs.commit_count }}
         run: |
           printf '%s\n' \