ci: run release-please via CLI instead of the googleapis action

[max-parke-scale]

What

Rewrites the release-please workflow (added in #321) to run the release-please CLI under actions/setup-node, instead of googleapis/release-please-action.

Why

After #321 merged, the workflow failed at startup on every push to main (startup_failure, no logs, no release PR cut). The merged YAML is valid and the action SHA resolves — the cause is the org Actions allow-list: googleapis/release-please-action isn't on it. (Every other workflow here uses only actions/, astral-sh/, docker/, stainless-api/, codecov/, dorny/; the Actions-policy API is admin-only/403 for me, so I couldn't read it directly, but the signature is unambiguous.)

Fix

Run npx release-please@16 release-pr + github-release (manifest mode — same as the action did internally) under actions/setup-node@v4, which is allow-listed (actions/* is used throughout the repo). No third-party action → allow-list-proof.

Verified the CLI commands (release-pr/github-release; manifest-pr/manifest-release are deprecated aliases) and flags (--token, --repo-url, --config-file, --manifest-file) against release-please@16.

After merge

Runs on main; once a feat/fix lands (or via workflow_dispatch) it opens the first release PR → merging that cuts the first vX.Y.Z tag. Config + manifest are unchanged from #321.

🧑‍💻🤖 — posted via Claude Code

Greptile Summary

Rewrites the release-please workflow to run the CLI via npx under actions/setup-node@v4 instead of the blocked googleapis/release-please-action. The two CLI commands (release-pr + github-release) replicate what the action did internally, and issues: write is added so the CLI can apply autorelease:* labels.

• Replaces googleapis/release-please-action@5c625bfb5… with two npx --yes release-please@16 invocations that run sequentially in one step; the existing --config-file / --manifest-file paths are unchanged.
• Adds issues: write permission so the CLI can label release PRs via the GitHub Issues API without a permissions error.

Confidence Score: 5/5

Safe to merge — the change is a like-for-like replacement of a blocked action with equivalent CLI commands, and all required permissions are granted.

The rewrite correctly mirrors what the action did internally: release-pr opens/updates the release PR, github-release cuts the tag and release when that PR is merged. The issues: write permission is present for label management. The two npx invocations run in one shell step under set -eo pipefail, so a failure in either surfaces as a visible job failure rather than a silent skip. The only suggestions are around pinning (@v4 tag and @16 floating version) which are hygiene items, not correctness issues.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/release-please.yml	Replaces the blocked googleapis/release-please-action with equivalent npx release-please@16 CLI calls under actions/setup-node@v4; adds issues: write permission for label management.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub (push to main)
    participant Runner as ubuntu-latest runner
    participant NPX as npx release-please@16
    participant GHAPI as GitHub API

    GH->>Runner: trigger workflow
    Runner->>Runner: "actions/setup-node@v4 (Node 20)"
    Runner->>NPX: release-pr --token --repo-url --config-file --manifest-file
    NPX->>GHAPI: fetch config + manifest (via API, no checkout needed)
    GHAPI-->>NPX: release-please-config.json, .release-please-manifest.json
    NPX->>GHAPI: create/update release PR (contents:write, pull-requests:write)
    NPX->>GHAPI: "apply autorelease:* labels (issues:write)"
    GHAPI-->>NPX: done
    NPX-->>Runner: exit 0
    Runner->>NPX: github-release --token --repo-url --config-file --manifest-file
    NPX->>GHAPI: check for merged release PRs
    alt Release PR was merged
        NPX->>GHAPI: create tag + GitHub Release (contents:write)
        GHAPI-->>NPX: release created
    else No merged release PR
        NPX-->>Runner: no-op, exit 0
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub (push to main)
    participant Runner as ubuntu-latest runner
    participant NPX as npx release-please@16
    participant GHAPI as GitHub API

    GH->>Runner: trigger workflow
    Runner->>Runner: "actions/setup-node@v4 (Node 20)"
    Runner->>NPX: release-pr --token --repo-url --config-file --manifest-file
    NPX->>GHAPI: fetch config + manifest (via API, no checkout needed)
    GHAPI-->>NPX: release-please-config.json, .release-please-manifest.json
    NPX->>GHAPI: create/update release PR (contents:write, pull-requests:write)
    NPX->>GHAPI: "apply autorelease:* labels (issues:write)"
    GHAPI-->>NPX: done
    NPX-->>Runner: exit 0
    Runner->>NPX: github-release --token --repo-url --config-file --manifest-file
    NPX->>GHAPI: check for merged release PRs
    alt Release PR was merged
        NPX->>GHAPI: create tag + GitHub Release (contents:write)
        GHAPI-->>NPX: release created
    else No merged release PR
        NPX-->>Runner: no-op, exit 0
    end

Loading

Comments Outside Diff (1)

1. .github/workflows/release-please.yml, line 12-14 (link)

   Grant label permissions

   The CLI still applies and removes release-please labels on release PRs, and those calls go through GitHub's Issues API. This workflow only grants contents: write and pull-requests: write, so the job can fail with a permissions error when it tries to add or remove labels like autorelease: pending. Add issues: write here so the CLI has the same label permissions the release flow needs.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: .github/workflows/release-please.yml
   Line: 12-14
   
   Comment:
   **Grant label permissions**
   
   The CLI still applies and removes release-please labels on release PRs, and those calls go through GitHub's Issues API. This workflow only grants `contents: write` and `pull-requests: write`, so the job can fail with a permissions error when it tries to add or remove labels like `autorelease: pending`. Add `issues: write` here so the CLI has the same label permissions the release flow needs.
   
   How can I resolve this? If you propose a fix, please make it concise.

   

_{Reviews (3): Last reviewed commit: "ci: run release-please via CLI instead o..." | Re-trigger Greptile}