From ce2c1e1367246a66e610664ab06627e2830842cf Mon Sep 17 00:00:00 2001 From: "Michael A. Smith" Date: Wed, 20 May 2026 10:46:17 -0400 Subject: [PATCH] ci(release-please): pin reusable @1.0.0 and use `secrets: inherit` github-workflows-public 1.0.0 reads the App credentials from the org-level RELEASE_PLEASE_CLIENT_ID variable and RELEASE_PLEASE_PRIVATE_KEY secret automatically, so callers only need `secrets: inherit`. PRs opened by the App identity trigger downstream pull_request workflows; PRs opened by the default GITHUB_TOKEN do not (GitHub anti-recursion), which previously left release PRs unmergeable on repos with required checks. Assisted-by: Claude Code --- .github/workflows/release-please.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index bcf5c7c..dc29149 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -10,10 +10,11 @@ permissions: {} jobs: release-please: - uses: opencoreemr/github-workflows-public/.github/workflows/release-please-reusable.yml@0.0.6 + uses: opencoreemr/github-workflows-public/.github/workflows/release-please-reusable.yml@1.0.0 permissions: contents: write pull-requests: write + secrets: inherit # Build and attach PHAR to release. # Called directly because release events from GITHUB_TOKEN don't trigger