ci: release automation follow-ups (self-pin push, remove deploy-key rotation reminder) - #645
Merged
Merged
Conversation
The Azure org permanently disables 'Allow GitHub Actions to create and approve pull requests', so gh pr create failed every release with a misleading 'PR may already exist' fallback. Remove the doomed call and instead print a ::notice:: with the compare link so the releaser opens the PR in one click. Also drop the now-unused pull-requests: write permission and GH_TOKEN env from the self-pin jobs (they only use git via the deploy key), and rename the step to 'push branch'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Azure/login is public, so a GitHub issue reminder to rotate the release deploy key is publicly visible. Post to a private Teams channel via a Power Automate 'Workflows' webhook (TEAMS_WEBHOOK_URL secret) instead. Needs no GitHub permissions (empty permissions block, no GITHUB_TOKEN) - the webhook URL is the only credential. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
The remaining findings are minor naming nits and do not block approval.
Pull request overview
Updates release and rollback self-pin automation to push branches with manual compare links, and removes the scheduled deploy-key reminder.
Changes:
- Removes automated PR creation and unnecessary permissions.
- Adds compare-link notices for manually opening PRs.
- Deletes the deploy-key rotation reminder workflow.
File summaries
| File | Reviewed changes |
|---|---|
.github/workflows/rollback.yml |
Pushes self-pin branches and provides a compare link; minor stale job-name nit remains. |
.github/workflows/release.yml |
Applies the manual self-pin PR flow; minor stale job-name nit remains. |
.github/workflows/deploy-key-rotation-reminder.yml |
Removes the scheduled rotation reminder workflow. |
Review details
Suppressed comments (2)
.github/workflows/release.yml:196
- This job is still identified as
open-selfpin-pr, but it no longer opens a pull request; workflow run labels will therefore continue to promise behavior that the job does not perform. Please rename the job ID and update the remainingopen-selfpin-prreference in.github/dependabot.ymlso the manual-PR flow is clear.
- name: Bump azure/login self-references and push branch
.github/workflows/rollback.yml:126
- This job is still identified as
open-selfpin-pr, but it no longer opens a pull request; workflow run labels will therefore continue to promise behavior that the job does not perform. Please rename the job ID and update the remainingopen-selfpin-prreference in.github/dependabot.ymlso the manual-PR flow is clear.
- name: Roll back azure/login self-references and push branch
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Teresa Ritorto (teresaritorto)
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two follow-ups to the release/rollback automation:
Changes
Self-pin: push the branch, do not create the PR (
release.yml,rollback.yml)After a release or rollback, the self-pin job repoints this repo's own
azure/login@<sha>references to the new release commit. It previously rangh pr create, but theAzureorg disables "Allow GitHub Actions to create and approve pull requests", so that call could never succeed.chore/pin-azure-login-*branch and prints a::notice::compare link for the releaser to open the PR with one click.pull-requests: writepermission and theGH_TOKENenv from the step.No behavioural change to how the branch itself is produced. Only the PR-creation attempt is removed.
Remove
deploy-key-rotation-reminder.ymlThe scheduled workflow that pinged a reminder to rotate
RELEASE_DEPLOY_KEYis deleted. RWhy
gh pr createstep was dead code that logged a failure or a no-op on every release. Pushing the branch plus a compare link is the supported path in this org.