From b8b6b28ce9ff92a213c707e2a7d373a9a97d715f Mon Sep 17 00:00:00 2001
From: Rongxin Liu <10591665+rongxin-liu@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:48:09 -0400
Subject: [PATCH] ci(cli): use CLI_RELEASE_PAT so release-please can create
 cli-v* tags

The cli-release-tags ruleset restricts cli-v* tag creation to the Admin
role, and github-actions[bot] can't be granted a repo-level bypass (org
policy). The default GITHUB_TOKEN therefore fails to publish the release
("Cannot create ref due to creations being restricted"). Switch to the
admin CLI_RELEASE_PAT, which satisfies the existing bypass.
---
 .github/workflows/cli-release-please.yaml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/cli-release-please.yaml b/.github/workflows/cli-release-please.yaml
index c927723e..63e90796 100644
--- a/.github/workflows/cli-release-please.yaml
+++ b/.github/workflows/cli-release-please.yaml
@@ -11,14 +11,15 @@ name: cli Release Please
 # .release-please-manifest.json (the `cli` package key IS the path). The
 # `cli-v*` tag scheme is namespaced apart from the web app's `web-v*` tags.
 #
-# Token model: release-please runs with GITHUB_TOKEN. A tag pushed by
-# GITHUB_TOKEN does NOT retrigger other workflows (Actions' recursion guard),
-# so cli-release.yaml is intentionally driven by the `cli-v*` tag push here.
-# NOTE: if a maintainers-only `cli-v*` tag protection rule is in place, the
-# Actions bot (github-actions[bot]) must be allowed to create `cli-v*` tags, or
-# the Release PR will merge without a tag being pushed and no build will fire.
-# (Also requires "Allow GitHub Actions to create and approve pull requests" so
-# the Release PR can be opened.)
+# Token model: release-please runs with CLI_RELEASE_PAT (an admin PAT), NOT the
+# default GITHUB_TOKEN. The `cli-release-tags` ruleset restricts `cli-v*` tag
+# creation to the Admin role, and github-actions[bot] can't be granted a repo-
+# level bypass here (org policy), so the bot's GITHUB_TOKEN cannot create the
+# tag. An admin PAT satisfies the Admin-role bypass. A side benefit: a tag
+# pushed by a PAT DOES retrigger cli-release.yaml (no Actions recursion guard),
+# which builds and publishes the `gh-teacher` and `gh-student` extensions.
+# (Opening the Release PR also requires "Allow GitHub Actions to create and
+# approve pull requests".)
 
 on:
   push:
@@ -45,7 +46,7 @@ jobs:
       - uses: googleapis/release-please-action@v5
         id: release
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CLI_RELEASE_PAT }}
           target-branch: main
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json