[xmfcx]

Pull Request

Summary

The Release workflow fails on every push to master, so no release has run in this repository. This PR removes the GH_PAT token from its checkout step, so that the job uses the default GITHUB_TOKEN.

🐛 Bug Fixes

1. Release fails at checkout: the Checkout repository step of the release job fails with Input required and not supplied: token, for example in run 39392670801 on 6817810 and in run 38862362298.

---

🔍 Root Cause Analysis

Problem Description

The checkout step uses token: ${{ secrets.GH_PAT }} (release.yml:35-40). This repository does not give the job a GH_PAT secret, so the input is empty and checkout stops.

Because of this, the PRs merged so far did not make a release: the repository has no tags and no releases, and the version in pyproject.toml is still 2.62.0.

Why GH_PAT was added

This repository was moved from tier4/autoware_lanelet2_to_opendrive. There, tier4/autoware_lanelet2_to_opendrive#478 added the token:

1. The release job pushes a version-bump commit and a tag directly to master.
2. On 2026-04-30, the master ruleset of the tier4 repository was changed. It required 4 status checks, and only organization admins could bypass it.
3. GITHUB_TOKEN acts as github-actions[bot], which could not bypass the ruleset. So every push was rejected with GH013 (example run).
4. fix(ci): use GH_PAT for release master push to satisfy branch ruleset tier4/autoware_lanelet2_to_opendrive#478 used GH_PAT, a personal token of an org admin that the tier4 repository already had. Its pushes could bypass the ruleset.

Why we do not need it here

The workflow file moved to this repository, but the ruleset and the secret did not.

• master has no ruleset and no branch protection. GET /repos/autowarefoundation/autoware_lanelet2_to_opendrive/branches/master gives "protected": false, and GET /repos/autowarefoundation/autoware_lanelet2_to_opendrive/rules/branches/master gives []. So nothing blocks a push from GITHUB_TOKEN, and the workflow already gives it contents: write.
• The job gets no GH_PAT secret. The checkout error Input required and not supplied: token in the runs above shows that the value is empty. So the token is the cause of the failure, not a fix for one.

Why we should not keep it

• A personal access token belongs to one person. It stays valid until somebody rotates it, and it stops working when that person leaves or loses access.
• An org-admin token can bypass every rule, so a leak would give much more access than this job needs.
• GITHUB_TOKEN is made for each run, only for this repository, and expires when the job ends.

If master gets a ruleset later, the release job needs an identity on its bypass list again. A GitHub App token is the better choice then, not a personal token.

We also did not use the fallback form token: ${{ secrets.GH_PAT || github.token }}. It would keep an unused path for a personal token, and nothing here needs one.

---

🛠️ Changes

.github/workflows/release.yml

Remove token: ${{ secrets.GH_PAT }} and its comment from the checkout step of the release job. actions/checkout then uses GITHUB_TOKEN, and later git push and mike deploy --push use the same credential.

One side effect: a push with GITHUB_TOKEN does not start other workflows. So the version-bump commit does not start ci.yml on master. No workflow triggers on tags.

---

✅ Testing

• SKIP=mypy pre-commit run --files .github/workflows/release.yml: all hooks passed or skipped.
• No workflow ran. The release job runs only on a push to master, so the first release after this PR merges is the real test.

---

📊 Expected Results

• The next push to master with a bump label passes checkout, bumps the version, pushes the tag, and makes a GitHub release.
• The job attaches the documentation zip and PDF to the release. mike creates the gh-pages branch and pushes the docs to it.
• GitHub Pages is not turned on for this repository (has_pages: false). So the docs are not served on a website until somebody turns Pages on.

---

⚠️ Breaking Changes

None.

---

📝 Related Issues

• Undoes the token part of tier4/autoware_lanelet2_to_opendrive#478 for this repository.

AI usage

AI usage: Written with Claude Code in Breeze from the failed Release runs. Claude Code read the run log, the workflow history, and the branch protection and rulesets of master, then removed the token line.

Self-review: One review round by a separate AI session with a clean context, on 87ef2ed. It found no must-fix issue. It confirmed that master and gh-pages have no rules, that contents: write covers every push of the job, and that no other file uses GH_PAT. From its suggestions, I made the secret claim match the evidence, added the docs and Pages lines to Expected Results, and explained why we did not use a GH_PAT || github.token fallback. It also noted that the workflow has no concurrency group, so two merges close together can make the second bump push fail. This PR does not change that.

Verification: pre-commit ran on the changed file, and all hooks passed or skipped. The PR checks passed, except claude-review. The Release workflow did not run.

SKIP=mypy pre-commit run --files .github/workflows/release.yml

• check yaml, trim trailing whitespace, fix end of files, mixed line ending, check for added large files, and check for merge conflicts printed Passed. The Python hooks printed Skipped, because no Python file changed.
• Did not run: actionlint, because it is not installed on my machine.
• Did not run: the Release workflow, because it runs only on a push to master.

PR checks on 87ef2ed

• Passed: lint-and-format, test (3.10, carla), docs, qc-validate, Workflow YAML Syntax Check, Check Version Bump Label, Check Links, check-src-changes, and DCO.
• Failed: claude-review, at the Run Claude Code Review step of claude-code-review.yml. This PR does not change that workflow.