[helenyugithub]

Why

nominal-io/release-please-action runs dist/index.js, an ncc bundle that includes @nominal-io/release-please. GitHub never runs npm install for JavaScript actions, so a release of this fork has no effect until someone bumps the dependency in the action repo and commits a rebuilt dist/. Nobody did that between May and September, so scout's bazel-deps-query config key was silently ignored until nominal-io/release-please-action#7.

What

• New update-release-please-action.yaml. This reusable workflow checks out the action repo and runs npm ci, npm install @nominal-io/release-please@<version>, npm run build and npm test. If that changes anything, it opens a draft PR titled chore(deps): update @nominal-io/release-please to v<version> from automation/update-release-please, or updates the PR that is already open. It also has a workflow_dispatch trigger with a version input, for retries and backfills.
• publish.yaml calls it after npm publish succeeds and passes the version it published.
• publish.yaml's bare actions/checkout@v4 is now pinned to 11d5960a…, the SHA the repo already uses. v4 points to that commit today, so the same code runs.

Design notes

• Two jobs. nombotv2 is an "always" bypass actor on the action repo's main ruleset, so a nombotv2 token can push to main without review. The pinned token action can't limit a token to one repo, and nombotv2 is installed on every repo in the org. So:
  • build runs all npm code (install scripts, build, tests) with only this repo's read-only GITHUB_TOKEN. packages: read is enough because the private package is linked to this repo.
  • build hands a patch to pull-request as an artifact.
  • pull-request mints the nombotv2 token (contents: write, pull_requests: write, revoked when the job ends) and never runs npm. It refuses any patch that touches files other than package.json, package-lock.json and dist/.
• Separate workflow file. publish.yaml already has an input-less workflow_dispatch that publishes. Adding a version input there would either mix publishing with bumping or take away manual publishing.
• One branch, force-pushed. A newer release replaces a pending bump in the same PR, so old bumps don't pile up the way chore(deps): update @nominal-io/release-please to v18.2.2 release-please-action#6 did.
• Exact version. The workflow installs @<version>, not @^<version>, so a backfill can't resolve to a newer release. npm still writes ^<version> to package.json, as in chore(deps): update @nominal-io/release-please to v18.3.0 release-please-action#7.
• Input checks. Malformed versions and downgrades are refused.
• No-op runs. If the action repo is already on that version and dist/ is up to date, the run ends with a notice and opens no PR.

Testing

Exercised

• actionlint 1.7.12 (with shellcheck). 0 errors on all four workflows. A negative test confirmed that it checks this call's inputs and secrets against the reusable workflow.
• Reproducibility.
  • Run on chore(deps): update @nominal-io/release-please to v18.3.0 release-please-action#7's parent (4b51bf0), the build commands regenerate chore(deps): update @nominal-io/release-please to v18.3.0 release-please-action#7's tree byte for byte. That holds on macOS with Node 20.19.0 and on Linux x86_64 with Node 20.20.2, which node-version: 20 resolves to.
  • On current main (7f728fd) they change nothing.
  • 24 tests pass in every case.
• build job end to end with act. Ran via workflow_dispatch with version=18.3.0: checkout of the action repo, setup-node registry auth, npm ci, install, build and test all passed. It ended with the "already on 18.3.0 … nothing to do" notice. act 0.2.54 can't load node24 actions, so this run used a copy with only the (skipped) upload-artifact step removed.
• Step scripts, extracted from the YAML and run directly.
  • Version validation: 7 cases, including injection attempts.
  • Downgrade guard: 9 cases, on GNU bash and sort.
  • Diff: both the no-op and the changed case.
  • Commit and push into a local bare repo: the pushed tree equals chore(deps): update @nominal-io/release-please to v18.3.0 release-please-action#7's tree, the author is nombotv2[bot], and a re-run force-pushes cleanly. A patch that also edits .github/workflows/ci.yaml is refused and nothing is pushed.
  • PR step with a stubbed gh: creates a draft when no PR is open, and PATCHes the PR when one is.
  • Read-only API calls confirmed the head= filter.

Not exercised (can't run before merge or without the app key)

• The release trigger, and the workflow_call from publish.yaml.
• Minting the nombotv2 token, and the real push and PR creation on the action repo.
• This repo's GITHUB_TOKEN reading the private package. Locally I used a PAT with read:packages.
• upload-artifact and download-artifact on GitHub.

After merge

Run the backfill for the current version:

gh workflow run update-release-please-action.yaml -R nominal-io/release-please -f version=18.3.0

nominal-io/release-please-action#7 is already merged, so this run should end in build with "already on 18.3.0 … nothing to do", skip pull-request, and open no PR. That run exercises the real GITHUB_TOKEN package read. The first real release exercises the rest.

🤖 Generated with Claude Code