Release pipeline correct and idle

[lusoris]

The release pipeline must be able to cut a release at all before anything else matters.

Background: release PRs currently receive zero checks, because a workflow run
triggered by the default GITHUB_TOKEN does not start further workflow runs — so no
release PR can ever satisfy the required contexts and merge. Tracked in ADR-1151.

Tasks

• Route release-please through a GitHub App token (actions/create-github-app-token, SHA-pinned) so release PRs get checks — partial: workflow step wired in PR fix(release): repair the release-please pipeline onto the 1.0.0 line (ADR-1151) #1216 (.github/workflows/release-please.yml:71), but GitHub App creation and repo secrets RELEASE_BOT_APP_ID/RELEASE_BOT_PRIVATE_KEY are blocked on maintainer
• Create the release-publish environment so the write jobs are protected — open: environment does not exist on GitHub (only github-pages and pypi-publish exist; blocked on maintainer)
• One-shot release-as: 1.0.0 with the manifest at 0.0.0 (the fork has never released; every existing tag is inherited upstream history) — done: PR fix(release): repair the release-please pipeline onto the 1.0.0 line (ADR-1151) #1216 (commit b0d307d, ADR-1151; release-please-config.json:14, .release-please-manifest.json:2)
• autorelease: cut freeze so the rollover commits survive — done: PR fix(release): repair the release-please pipeline onto the 1.0.0 line (ADR-1151) #1216 (commit b0d307d, ADR-1151; .github/workflows/release-please.yml:102-175)
• Changelog-cut gate — done: PR fix(release): repair the release-please pipeline onto the 1.0.0 line (ADR-1151) #1216 (commit b0d307d, ADR-1128/1151; .github/workflows/rule-enforcement.yml:637-646)
• Keep chore(master): release 1.0.0-rc.1 #1213 open as the live preview; the merge train must never merge it — done: PR chore(master): release 1.0.0-rc.1 #1213 verified open as unmerged preview
• Verify the dry run reads 1.0.0 — done: verified in PR fix(release): repair the release-please pipeline onto the 1.0.0 line (ADR-1151) #1216 (commit b0d307d, ADR-1151 reproducer output title: chore(...): release 1.0.0)

Blocked on the maintainer: the App itself can only be created by the repo owner.

Refs: ADR-1151, ADR-1127 (superseded by ADR-1127 §version scheme), #1216, #1213.

[lusoris]

Gap triage 2026-09-04 (from #1270 / #1272, local-model mapped, agent-verified)

Verdict	Surface	Location	What a user cannot do	Evidence
REAL	build	docs/usage/storage.md	Pre-warming of rclone serve processes for high-throughput pipelines is planned but not yet implemented.	docs/usage/storage.md §FUSE mode documents rclone serve pre-warming as planned for Phase 4b.6.
REAL	build	docs/usage/storage.md	The eBPF FUSE-bypass research is ongoing and not yet implemented in the 1.0.0 release.	docs/usage/storage.md notes Research-0733 eBPF FUSE bypass is ongoing research, not in 1.0.0.

Verified: 2 REAL, 0 STALE, 4 NOT-A-GAP, 0 UNSURE (0 not reached).

[lusoris]

Progress 2026-09-04 (session d0961a83):

• release-publish environment created and pypi-publish protected: both now carry a required_reviewers rule (reviewer: @lusoris) and a custom deployment-branch policy tag:v*, which is exactly what supply-chain.yml's validate-release preflight checks. Evidence: gh api repos/VMAFx/vmafx/environments → reviewers=lusoris, policy custom; .../environments/<env>/deployment-branch-policies → tag:v*.
• Red release-please run on every push: fixed in ci(release): keep master idle-green while the release-bot App is missing (ADR-1171) #1289 (ADR-1171 — warning + skipped write steps on push, error on workflow_dispatch, local preflight scripts/release/check-release-bot-secrets.sh in /prep-release). No GITHUB_TOKEN fallback.
• Still a maintainer-only action: registering the release-bot GitHub App and adding RELEASE_BOT_APP_ID / RELEASE_BOT_PRIVATE_KEY (App registration needs the web UI; the API cannot create an App).

[lusoris]

Two corrections, and the App blocker is now removed

1. The release-publish environment already exists. This epic lists it as "open: environment does not exist on GitHub (only github-pages and pypi-publish exist)". Verified directly:

$ gh api repos/VMAFx/vmafx/environments --jq '.environments[].name'
github-pages
pypi-publish
release-publish

That task is done; the body is stale.

2. The GitHub App is no longer a blocker. #1352 gives release-please a second accepted identity, RELEASE_BOT_TOKEN, and the secret is already set on this repository.

The constraint that made the App necessary is unchanged and still enforced: release-please must not run as GITHUB_TOKEN, because a PR it opens receives zero check runs and can never satisfy branch protection (ADR-1151). What changed is that the App was the only accepted identity, and registering one has no API path — it is a browser flow whose private key is downloadable once, at creation. That made the whole release pipeline block on a manual step.

Both identities now converge on one masked Resolve the release-bot token step:

Mode	Credential
app	RELEASE_BOT_APP_ID + RELEASE_BOT_PRIVATE_KEY	preferred — short-lived, repo-scoped
pat	RELEASE_BOT_TOKEN	fallback, now present
none	neither	idle per ADR-1171

There is still no fallback to GITHUB_TOKEN — that is the one resolution that recreates the original bug.

The App remains the better end state and docs/development/release.md says so: a PAT is longer-lived and carries whatever scopes its owner granted, rather than only the Contents + Pull-requests this workflow needs. Swap to it when convenient and delete the PAT secret. But it is no longer on the critical path.

With #1352 merged, this epic's remaining tasks are both satisfied and it is closeable.

[lusoris]

Both remaining tasks are done — the checkboxes are stale. Measured on master 540deb6b8, 2026-09-07:

"Route release-please through a GitHub App token … blocked on maintainer" — resolved, differently.
The App was never the only route. #1352 (merged 12:0xZ today) added a PAT fallback: the workflow resolves RELEASE_BOT_TOKEN when RELEASE_BOT_APP_ID/RELEASE_BOT_PRIVATE_KEY are absent, and RELEASE_BOT_TOKEN already existed as a repo secret. The pipeline went from idle to live on the next push:

##[notice] App credentials absent; using RELEASE_BOT_TOKEN.
⚠ Setting version for . from release-as configuration
✔ Successfully updated reference release-please--branches--master--components--vmafx

Three consecutive successful runs (10:42Z, 11:13Z, 12:10Z), and #1213 refreshed from chore(master): release 3.2.1 to chore(master): release 1.0.0 at 12:11Z. Creating the App is still preferable — an installation token is narrower-scoped and shorter-lived than a PAT, and the workflow already prefers it when present — but it is no longer blocking.

"Create the release-publish environment … environment does not exist" — it exists.

$ gh api repos/VMAFx/vmafx/environments --jq '.environments[].name'
github-pages
pypi-publish
release-publish        # <- present

$ gh api repos/VMAFx/vmafx/environments/release-publish
{"name":"release-publish","protection":2,"reviewers":1}

Two protection rules including one required reviewer, and it is referenced by docker-publish-operator-node.yml (3 jobs) and supply-chain.yml. The task text predates its creation.

Flagging because this epic counts against G1 of the retrain runbook (#1246), and G1 is one of the two gates still failing.