Repository navigation
fix(release): suppress issue side effects in org-config releases #108
Description
🤖 Generated by the Daily AI Engineer
Evidence
The org-config release workflow still calls the shared create-release.yaml at immutable v8.0.0. It grants top-level contents, issues, pull-requests, and id-token write permissions and cannot opt out of semantic-release success/fail hooks. Its latest real main release, run 29574602208, completed successfully and published the org-config release, so this is an active production consumer.
Shared incident devantler-tech/actions#610 showed that post-publication issue hooks can turn an ambiguous bare issue reference into a red release after the tag and GitHub Release already exist. Actions v10.1.0 is immutable at 47f0d9b632581a613963a2d25c243713f24c32a0; its reusable release workflow declares permissions: {} and creates a contents-only App token when disable-issue-side-effects is enabled.
Audience and impact
Org-config operators need the release result to reflect whether the tag and release actually published. The current broad caller permission declaration also grants capabilities the reusable workflow no longer needs.
Expected behavior
Org-config releases should preserve verification, notes, tagging, assets, and GitHub Release publication while omitting semantic-release success/fail issue side effects. The caller should grant no GITHUB_TOKEN permissions; the reusable workflow should use only its contents-write App token. The separate CD workflow keeps its own scoped OIDC permission for artifact signing.
Acceptance criteria
- Pin the reusable
create-releaseworkflow to immutable Actions v10.1.0. - Set
disable-issue-side-effects: trueand replace release-workflow top-level permissions withpermissions: {}. - Preserve triggers and App-secret wiring; do not change the independent CD permission boundary.
- Prove the old workflow contract fails the new structural assertion and the updated contract passes it.
- Pass org-config render and workflow security validation.
- Exercise the real branch release workflow and observe contents-only App permission plus
--success false --fail falsewithout publication away frommain. - Observe the next real main release and signed org-config artifact publication, then record the evidence on devantler-tech/actions#610.
Rough size
Small, one-workflow consumer rollout.
Part of devantler-tech/actions#610.
Activity
coderabbitai commentedon Jul 17, 2026
🔗 Related PRs
#76 - fix(ci): release revert commits so reverts reach the cluster [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#90 - feat: archive the reusable-workflows repository (phase 2) [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!