From 5ea650dd1ba5cb2f08a986a8e2f89b5fc7fb0bf9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 6 Oct 2026 23:06:10 +0000
Subject: [PATCH 1/3] Initial plan


From 8f21692900fc1c628ff3412fb226066ef36f74bd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 6 Oct 2026 23:11:19 +0000
Subject: [PATCH 2/3] Fix release authentication with scoped GitHub Actions
 token

Co-authored-by: brendandburns <5751682+brendandburns@users.noreply.github.com>
---
 .github/workflows/release.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ed0799ac52..45facefec7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,9 @@ on:
 
 jobs:
   release:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     env:
       BAZELISK_SKIP_VERSION_CHECK: "1"
@@ -31,7 +34,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ secrets.PAT_TOKEN }}
+          token: ${{ github.token }}
       - name: Check Actor
         run: |
           # Release actor should be in the OWNER list
@@ -111,7 +114,7 @@ jobs:
       - name: Pull Request
         if: ${{ github.event.inputs.dry-run != 'true' }}
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh pr create \
             --base ${{ github.ref_name }} \
@@ -121,7 +124,7 @@ jobs:
       - name: Publish Release
         if: ${{ github.event.inputs.dry-run != 'true' }}
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh release create v${{ github.event.inputs.releaseVersion }} \
             --title "v${{ github.event.inputs.releaseVersion }}" \

From 027621d6b1501561ea9e5cffabd46daf981a6a11 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 6 Oct 2026 23:37:07 +0000
Subject: [PATCH 3/3] Remove automated release PR creation while retaining
 branch push

Co-authored-by: brendandburns <5751682+brendandburns@users.noreply.github.com>
---
 .github/workflows/release.yml | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45facefec7..8ba5efcad7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,6 @@ jobs:
   release:
     permissions:
       contents: write
-      pull-requests: write
     runs-on: ubuntu-latest
     env:
       BAZELISK_SKIP_VERSION_CHECK: "1"
@@ -111,16 +110,6 @@ jobs:
           git push https://${{ github.token }}@github.com/${{ github.repository }}.git \
             automated-release-${{ github.event.inputs.releaseVersion }}:automated-release-${{ github.event.inputs.releaseVersion }}
           git push https://${{ github.token }}@github.com/${{ github.repository }}.git v${{ github.event.inputs.releaseVersion }}
-      - name: Pull Request
-        if: ${{ github.event.inputs.dry-run != 'true' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh pr create \
-            --base ${{ github.ref_name }} \
-            --head automated-release-${{ github.event.inputs.releaseVersion }} \
-            --title "Automated Release: ${{ github.event.inputs.releaseVersion }}" \
-            --body ""
       - name: Publish Release
         if: ${{ github.event.inputs.dry-run != 'true' }}
         env: