chore: modify release flow in light of security changes (#10144)

.github/workflows/release-pr.yml

@@ -52,8 +52,21 @@ jobs:
         run: |
           git pull -f --no-rebase origin main:main
           yarn ts-node-script scripts/ci/add_changeset.ts
+      
+      # Configures git user as "google-oss-bot" for the next step
+      - name: Configure Git User
+        run: |
+          git config --global user.name "google-oss-bot"
+          git config --global user.email "[email protected]"
 
       - name: Create Release Pull Request
         uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # ratchet:changesets/action@v1
+        with:
+          # changesets action can automatically set up a git user
+          # but it will be google-actions[bot] which causes CLA problems
+          setupGitUser: false
         env:
+          # This token affects who the opening of the PR is credited to
+          # while the git user (above) determines the commit author.
+          # We want to set them both to match github-oss-bot.
           GITHUB_TOKEN: ${{ secrets.OSS_BOT_GITHUB_TOKEN }}

.github/workflows/release-prod.yml

@@ -43,8 +43,6 @@ jobs:
         # Release script requires git history and tags.
         fetch-depth: 0
         ref: ${{ github.event.inputs.release-branch }}
-        token: ${{ secrets.OSS_BOT_GITHUB_TOKEN }}
-        # This is ok since this workflow uses a custom token.
         persist-credentials: false
     - name: Yarn install
       run: yarn
@@ -129,7 +127,16 @@ jobs:
         $RELEASE_TRACKER_URL/logProduction
       env:
         STEPS_GET_VERSION_OUTPUTS_BASE_VERSION: ${{ steps.get-version.outputs.BASE_VERSION }}
+    - name: Publish git tags
+      # This commonly runs into permissions errors. Should not block the rest
+      # of the workflow. But should fail workflow so we notice it. So putting
+      # near the end.
+      run: yarn ts-node scripts/release/publish-git-tags.ts
+      # The script injects this token into the git push command
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Create GitHub release
+      # Depends on generated tag above.
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |

scripts/release/publish-git-tags.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { exec } from 'child-process-promise';
+import { projectRoot as root } from '../utils';
+
+async function pushReleaseTagsToGithub() {
+  // Get tags pointing to HEAD
+  // When running the release script, these tags should be release tags created by changeset
+  const { stdout: rawTags } = await exec(`git tag --points-at HEAD`);
+
+  if (!rawTags.trim()) {
+    console.error('No tags found pointing to HEAD.');
+    process.exit(1);
+  }
+
+  const tags = rawTags.split(/\r?\n/);
+
+  let { stdout: currentBranch } = await exec(`git rev-parse --abbrev-ref HEAD`);
+  currentBranch = currentBranch.trim();
+
+  if (!process.env.GITHUB_TOKEN) {
+    console.error('Unable to find GITHUB_TOKEN env variable.');
+    process.exit(1);
+  }
+
+  await exec(
+    `git -c http.extraHeader="Authorization: Bearer ${process.env.GITHUB_TOKEN}"` +
+      ` push origin ${currentBranch} ${tags.join(' ')} --no-verify`,
+    {
+      cwd: root
+    }
+  );
+}
+
+pushReleaseTagsToGithub();

scripts/release/release.ts

@@ -18,7 +18,7 @@
 import { exec } from 'child-process-promise';
 import { createPromptModule } from 'inquirer';
 import { publish, publishInCI } from './utils/publish';
-import { pushReleaseTagsToGithub, cleanTree, hasDiff } from './utils/git';
+import { cleanTree, hasDiff } from './utils/git';
 import {
   releaseType as releaseTypePrompt,
   validateVersions
@@ -178,16 +178,6 @@ export async function runRelease({
         await publish(releaseType);
       }
     }
-
-    /**
-     * Push tags to GitHub for prod releases only.
-     */
-    if (releaseType === ReleaseType.Production && !dryRun) {
-      /**
-       * Push release tags created by changeset or publishInCI() to GitHub
-       */
-      await pushReleaseTagsToGithub();
-    }
   } catch (err) {
     /**
      * Log any errors that happened during the process

scripts/release/utils/git.ts

@@ -44,18 +44,3 @@ export async function hasDiff() {
   console.log(diff);
   return !!diff;
 }
-
-export async function pushReleaseTagsToGithub() {
-  // Get tags pointing to HEAD
-  // When running the release script, these tags should be release tags created by changeset
-  const { stdout: rawTags } = await exec(`git tag --points-at HEAD`);
-
-  const tags = rawTags.split(/\r?\n/);
-
-  let { stdout: currentBranch } = await exec(`git rev-parse --abbrev-ref HEAD`);
-  currentBranch = currentBranch.trim();
-
-  await exec(`git push origin ${currentBranch} ${tags.join(' ')} --no-verify`, {
-    cwd: root
-  });
-}