[deanq]

Problem

#401 switched release-please to the built-in GITHUB_TOKEN for everything. Tagging works with it. Release PRs don't:

• GitHub does not start pull_request workflows for events made with GITHUB_TOKEN. The next release PR would never get the required Validation check, so it could only merge by admin bypass.
• runpod-python already shows this. Its release PRs (#594, #556, #539) are authored by github-actions and got only CodeQL, no CI.
• ci.yml's Guard only takes the release-PR bypass when the author is runpod-release-please-bot[bot].

1.21.1 shipped because #391 had been opened by the app before #401 merged.

Change

Run release-please twice in the same job:

1. Create release. Uses GITHUB_TOKEN with skip-github-pull-request: true. The app lacks workflows, which GitHub requires to tag a commit whose history changes .github/workflows/ unless a branch already points at it. After a normal release-PR merge, main points at the release commit.
2. Open or update release PR. Uses the app token (unscoped, as before ci: request workflows permission for the release token #399) with skip-github-release: true. This is the same token that opened chore: release 1.21.1 #391.

Releases run first, so a merged release PR is tagged before the PR step looks for outstanding ones. outputs.release_created / tag_name still come from step 1, so pypi-publish and the Linear jobs are unchanged.

Both inputs exist in release-please-action@v4 (action.yml, src/index.ts).

Known limit

If main moves past a release commit before it is tagged (a rerun after more merges), tagging with GITHUB_TOKEN 403s again. A temporary branch at the release commit fixes it, as was done for 1.21.1.

Test plan

• YAML parses. actionlint is clean apart from the custom runner labels it doesn't know.
• make quality-check passes.
• After merge, the Release run on this commit passes both steps: the app token is created and both release-please steps run. Both are no-ops here, because nothing is unreleased and ci: commits don't trigger a release.
• The next release PR is authored by runpod-release-please-bot and gets the full CI run plus Validation.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

There are no active review issues for the release workflow’s separation of release creation and PR management.

No open issues 🎉

What changed in this PR

This PR restores app-authored release PRs so they can trigger required CI checks, while retaining the built-in token for release creation.

Changes:

• Splits release-please into separate release-creation and PR-management steps.
• Restores GitHub App token generation for opening and updating release PRs.
• Creates releases first and preserves the existing outputs used by publishing and Linear jobs.

File	Description
.github/​workflows/​release-please.yml	Separates release and PR operations by token while preserving downstream release outputs.

_{Review effort: Balanced}