[deanq]

Merge only after an org owner grants the runpod-release-please app Workflows: Read and write. Without the grant, the token step fails with The permissions requested are not granted to this installation.

Why

Justin's tag probe (#402) used GITHUB_TOKEN on the allowlisted Blacksmith runner:

release-commit 50e819a (v1.21.1)  -> 403 Resource not accessible by integration
v1210-commit   c0f7843 (v1.21.0)  -> 201 Created
X-Accepted-Github-Permissions: contents=write; contents=write,workflows=write

#395 changed .github/workflows/ after v1.21.0, so creating the v1.21.1 tag needs workflows: write. GITHUB_TOKEN (#401) can never have that permission, so release-please fails at createRelease. The runner and the IP allow list are not the cause.

Change

• Release Please uses the release app token again, as before ci: create releases with the built-in token instead of the release app #401.
• The token requests contents, pull-requests and workflows write. issues is not requested: the app doesn't have it, and release-please adds labels and comments to the release PR through pull-requests.

After the grant and merge

The push to main runs Release. release-please tags v1.21.1 at 50e819a, creates the release, and PyPI Publish runs on runpod-4vCPU-ubuntu-2404.

Test plan

• make quality-check passes locally
• Workflow YAML parses; steps are token, then release-please
• After merge: Release run creates v1.21.1 and runpod-flash 1.21.1 appears on PyPI

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

An organization owner must confirm the release app installation has Workflows write permission, an external prerequisite for token creation and the release pipeline that cannot be verified from the diff.

No open issues 🎉

What changed in this PR

Restores GitHub App authentication for Release Please so it can tag releases that include workflow changes. Merging depends on an organization owner first granting the release app Workflows: Read and write.

Changes:

• Generates an app token requesting write access to contents, pull requests, and workflows, without requesting issues access.
• Passes the app token to Release Please instead of GITHUB_TOKEN.

File	Description
.github/​workflows/​release-please.yml	Adds app-token generation and uses it for Release Please authentication.

_{Review effort: Balanced}

[deanq]

Not needed: 1.21.1 released with GITHUB_TOKEN. The 403 came from tagging a commit no ref pointed at (main had moved past it), which GitHub gates behind the workflows permission. A temporary branch at 50e819a let release-please tag it.