feat: Use PAT for gemini-cli-robot in release workflows (#9804)

Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>

.github/actions/create-pull-request/action.yml

@@ -15,37 +15,33 @@ inputs:
     description: 'The branch to merge into.'
     required: true
     default: 'main'
-  app-id:
-    description: 'The ID of the GitHub App.'
-    required: true
-  private-key:
-    description: 'The private key of the GitHub App.'
+  github-token:
+    description: 'The GitHub token to use for creating the pull request.'
     required: true
   dry-run:
     description: 'Whether to run in dry-run mode.'
     required: false
     default: 'false'
+  working-directory:
+    description: 'The working directory to run the commands in.'
+    required: false
+    default: '.'
 
 runs:
   using: 'composite'
   steps:
-    - name: 'Generate GitHub App Token'
-      id: 'generate_token'
-      if: "inputs.dry-run == 'false'"
-      uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
-      with:
-        app-id: '${{ inputs.app-id }}'
-        private-key: '${{ inputs.private-key }}'
-        permission-pull-requests: 'write'
-        permission-contents: 'write'
-
     - name: 'Create and Approve Pull Request'
       if: "inputs.dry-run == 'false'"
       env:
-        GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+        GH_TOKEN: '${{ inputs.github-token }}'
       shell: 'bash'
+      working-directory: '${{ inputs.working-directory }}'
       run: |
         set -e
+        if ! git ls-remote --exit-code --heads origin "${{ inputs.branch-name }}"; then
+          echo "::error::Branch '${{ inputs.branch-name }}' does not exist on the remote repository."
+          exit 1
+        fi
         PR_URL=$(gh pr create \
           --title "${{ inputs.pr-title }}" \
           --body "${{ inputs.pr-body }}" \

.github/workflows/release-nightly.yml

@@ -14,7 +14,7 @@ on:
         description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
         required: false
         type: 'boolean'
-        default: false
+        default: true
       ref:
         description: 'The branch, tag, or SHA to release from.'
         required: false
@@ -31,38 +31,66 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          fetch-depth: 0
+
+      - name: 'Checkout Release Code'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
         with:
           ref: '${{ github.event.inputs.ref }}'
+          path: 'release'
           fetch-depth: 0
 
       - name: 'Setup Node.js'
         uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: './release/.nvmrc'
           cache: 'npm'
 
       - name: 'Install Dependencies'
+        working-directory: './release'
         run: 'npm ci'
 
+      - name: 'Print Inputs'
+        run: |
+          echo "${{ toJSON(github.event.inputs) }}"
+
       - name: 'Run Tests'
         if: "${{github.event.inputs.force_skip_tests != 'true'}}"
         uses: './.github/actions/run-tests'
         with:
           gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          working-directory: './release'
 
       - name: 'Get Nightly Version'
         id: 'nightly_version'
+        working-directory: './release'
         env:
           GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |
+          # Calculate the version using the centralized script
           VERSION_JSON=$(node scripts/get-release-version.js --type=nightly)
-          echo "RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)" >> "${GITHUB_OUTPUT}"
-          echo "RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)" >> "${GITHUB_OUTPUT}"
-          echo "NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)" >> "${GITHUB_OUTPUT}"
-          echo "PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)" >> "${GITHUB_OUTPUT}"
+
+          # Extract values for logging and outputs
+          RELEASE_TAG=$(echo "${VERSION_JSON}" | jq -r .releaseTag)
+          RELEASE_VERSION=$(echo "${VERSION_JSON}" | jq -r .releaseVersion)
+          NPM_TAG=$(echo "${VERSION_JSON}" | jq -r .npmTag)
+          PREVIOUS_TAG=$(echo "${VERSION_JSON}" | jq -r .previousReleaseTag)
+
+          # Print calculated values for logging
+          echo "Calculated Release Tag: ${RELEASE_TAG}"
+          echo "Calculated Release Version: ${RELEASE_VERSION}"
+          echo "Calculated Previous Tag: ${PREVIOUS_TAG}"
+
+          # Set outputs for subsequent steps
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "NPM_TAG=${NPM_TAG}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
 
       - name: 'Publish Release'
+        if: true
         uses: './.github/actions/publish-release'
         with:
           release-version: '${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
@@ -73,6 +101,7 @@ jobs:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
           dry-run: '${{ github.event.inputs.dry_run }}'
           previous-tag: '${{ steps.nightly_version.outputs.PREVIOUS_TAG }}'
+          working-directory: './release'
 
       - name: 'Create and Merge Pull Request'
         uses: './.github/actions/create-pull-request'
@@ -80,9 +109,9 @@ jobs:
           branch-name: 'release/${{ steps.nightly_version.outputs.RELEASE_TAG }}'
           pr-title: 'chore(release): bump version to ${{ steps.nightly_version.outputs.RELEASE_VERSION }}'
           pr-body: 'Automated version bump for nightly release.'
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
+          github-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
           dry-run: '${{ github.event.inputs.dry_run }}'
+          working-directory: './release'
 
       - name: 'Create Issue on Failure'
         if: '${{ failure() && github.event.inputs.dry_run == false }}'

.github/workflows/release-patch-1-create-pr.yml

@@ -52,15 +52,6 @@ jobs:
       - name: 'Install Script Dependencies'
         run: 'npm install yargs'
 
-      - name: 'Generate GitHub App Token'
-        id: 'generate_token'
-        uses: 'actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b'
-        with:
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
-          permission-pull-requests: 'write'
-          permission-contents: 'write'
-
       - name: 'Configure Git User'
         run: |-
           git config user.name "gemini-cli-robot"
@@ -72,7 +63,7 @@ jobs:
         id: 'create_patch'
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          GH_TOKEN: '${{ steps.generate_token.outputs.token }}'
+          GH_TOKEN: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
         continue-on-error: true
         run: |
           # Capture output and display it in logs using tee

.github/workflows/release-promote.yml

@@ -70,10 +70,10 @@ jobs:
           set -e
           STABLE_JSON=$(node scripts/get-release-version.js --type=stable ${{ github.event.inputs.stable_version_override && format('--stable_version_override={0}', github.event.inputs.stable_version_override) || '' }})
           PREVIEW_JSON=$(node scripts/get-release-version.js --type=preview ${{ github.event.inputs.preview_version_override && format('--preview_version_override={0}', github.event.inputs.preview_version_override) || '' }})
-          NIGHTLY_JSON=$(node scripts/get-release-version.js --type=nightly)
+          NIGHTLY_JSON=$(node scripts/get-release-version.js --type=promote-nightly)
           echo "STABLE_JSON_COMMAND=node scripts/get-release-version.js --type=stable ${{ github.event.inputs.stable_version_override && format('--stable_version_override={0}', github.event.inputs.stable_version_override) || '' }}"
           echo "PREVIEW_JSON_COMMAND=node scripts/get-release-version.js --type=preview ${{ github.event.inputs.preview_version_override && format('--preview_version_override={0}', github.event.inputs.preview_version_override) || '' }}"
-          echo "NIGHTLY_JSON_COMMAND=node scripts/get-release-version.js --type=nightly"
+          echo "NIGHTLY_JSON_COMMAND=node scripts/get-release-version.js --type=promote-nightly"
           echo "STABLE_JSON: ${STABLE_JSON}"
           echo "PREVIEW_JSON: ${PREVIEW_JSON}"
           echo "NIGHTLY_JSON: ${NIGHTLY_JSON}"
@@ -320,8 +320,7 @@ jobs:
           branch-name: '${{ steps.release_branch.outputs.BRANCH_NAME }}'
           pr-title: 'chore(release): bump version to ${{ needs.calculate-versions.outputs.NEXT_NIGHTLY_VERSION }}'
           pr-body: 'Automated version bump to prepare for the next nightly release.'
-          app-id: '${{ secrets.APP_ID }}'
-          private-key: '${{ secrets.PRIVATE_KEY }}'
+          github-token: '${{ secrets.GEMINI_CLI_ROBOT_GITHUB_PAT }}'
           dry-run: '${{ github.event.inputs.dry_run }}'
 
       - name: 'Create Issue on Failure'