From 5d296d9c72eb63726c6e3f8057878202367c6499 Mon Sep 17 00:00:00 2001
From: "privilegedescalation-paperclip[bot]"
 <268365651+privilegedescalation-paperclip[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 13:24:42 +0000
Subject: [PATCH] ci: pass GitHub App token secrets to release workflow (#24)

The shared release workflow now requires RELEASE_APP_ID and
RELEASE_APP_PRIVATE_KEY secrets for PR creation, since the org
blocks GITHUB_TOKEN from creating PRs.

Depends on privilegedescalation/.github#31

Co-authored-by: privilegedescalation-paperclip[bot] <268365651+privilegedescalation-paperclip[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 60e80a7..1f46f73 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,6 +15,9 @@ permissions:
 jobs:
   release:
     uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
       version: ${{ inputs.version }}
       upstream-repo: 'bitnami-labs/sealed-secrets'