From 0db846ddb501f94dcbb41d2fcf816aa3cbfe3083 Mon Sep 17 00:00:00 2001
From: Mitja Kleider <48825+emka@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:07:07 +0200
Subject: [PATCH] ci(release): publish releases with the workflow's own token

The personal token is refused when it creates a release, so the release
that follows a merged release pull request never happened. Publishing needs
no workflow runs, which is the only reason the pull request uses the personal
token, so the push-triggered job uses the default one.
---
 .github/workflows/release-please.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 250c2db..e5fcbaa 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Require the release token secret
+        if: github.event_name == 'workflow_dispatch'
         env:
           TOKEN: ${{ secrets.GH_CI_TOKEN }}
         run: |
@@ -27,13 +28,14 @@ jobs:
 
       - uses: googleapis/release-please-action@v5
         with:
-          # A pull request opened with the default GITHUB_TOKEN starts no
-          # workflow runs. The release pull request rewrites the firmware
-          # version in Cargo.toml and Cargo.lock, so leaving it ungated means
-          # the gates never run on the change most likely to break them, and
-          # the failure would surface only after merge, against a published
-          # tag.
-          token: ${{ secrets.GH_CI_TOKEN }}
+          # The release pull request is opened with the personal token: one
+          # opened with the default GITHUB_TOKEN starts no workflow runs. The
+          # pull request rewrites the firmware version in Cargo.toml and
+          # Cargo.lock, so leaving it ungated means the gates never run on the
+          # change most likely to break them, and the failure would surface
+          # only after merge, against a published tag. Publishing the release
+          # needs no workflow runs, so it uses the default token.
+          token: ${{ github.event_name == 'push' && secrets.GITHUB_TOKEN || secrets.GH_CI_TOKEN }}
           skip-github-pull-request: ${{ github.event_name == 'push' }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json