From d399a6d908dfd6f1ec35b6001cb3006ab3265d44 Mon Sep 17 00:00:00 2001
From: darken <darken@darken.eu>
Date: Fri, 1 May 2026 08:59:03 +0200
Subject: [PATCH] fix(ci): Drop redundant explicit dispatch in release-prepare

---
 .claude/rules/release.md              |  4 ++--
 .github/workflows/release-prepare.yml | 12 ------------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/.claude/rules/release.md b/.claude/rules/release.md
index 885748a4..e91f32f5 100644
--- a/.claude/rules/release.md
+++ b/.claude/rules/release.md
@@ -12,7 +12,7 @@ gh workflow run release-prepare.yml -f bump_kind=build -f dry_run=true
 gh workflow run release-prepare.yml -f bump_kind=build -f dry_run=false
 ```
 
-After `dry_run=false`: Job 1 computes + writes the summary, then Job 2 immediately commits/tags/pushes/dispatches (no env gate — cancel the run between Job 1 and Job 2 if the summary looks wrong; you have ~seconds). `release-tag.yml` then runs `validate-tag` and the existing `release-github` (`foss-production` approval) + `release-gplay` (`gplay-production` approval) jobs — those are the two human checkpoints, matching the pre-migration UX.
+After `dry_run=false`: Job 1 computes + writes the summary, then Job 2 immediately commits/tags/pushes (no env gate — cancel the run between Job 1 and Job 2 if the summary looks wrong; you have ~seconds). The tag push naturally triggers `release-tag.yml` (the App-token push fires `on: push:` workflows; only `GITHUB_TOKEN`-pushes are suppressed). `release-tag.yml` then runs `validate-tag` and the existing `release-github` (`foss-production` approval) + `release-gplay` (`gplay-production` approval) jobs — those are the two human checkpoints, matching the pre-migration UX.
 
 ## Inputs
 
@@ -75,4 +75,4 @@ Other apps in the org can reuse the same App + secrets — just install the App
 
 ## Stuck-dispatch recovery
 
-If Job 2's atomic push lands but `gh workflow run release-tag.yml` fails (rare — Job 1's auth precheck should prevent it), the tag is public but no pipeline runs. Re-dispatch: `gh workflow run release-tag.yml --ref v<new> -f dry_run=false`.
\ No newline at end of file
+If Job 2's atomic push lands but the natural `on: push:` trigger doesn't fire `release-tag.yml` (rare — would mean GitHub dropped the event), the tag is public but no pipeline runs. Re-dispatch manually: `gh workflow run release-tag.yml --ref v<new> -f dry_run=false`.
\ No newline at end of file
diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml
index fa3badce..54dfe3f0 100644
--- a/.github/workflows/release-prepare.yml
+++ b/.github/workflows/release-prepare.yml
@@ -39,13 +39,11 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: read
-      actions: read
     outputs:
       new_name: ${{ steps.plan.outputs.new_name }}
       new_code: ${{ steps.plan.outputs.new_code }}
       current_name: ${{ steps.plan.outputs.current_name }}
     env:
-      GH_TOKEN: ${{ github.token }}
       INPUT_BUMP_KIND: ${{ inputs.bump_kind }}
       INPUT_VERSION_TYPE: ${{ inputs.version_type }}
       INPUT_VERSION_OVERRIDE: ${{ inputs.version_override }}
@@ -65,9 +63,6 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Verify gh auth and dispatch capability
-        run: gh workflow view release-tag.yml > /dev/null
-
       - name: Compute and validate
         id: plan
         run: |
@@ -223,13 +218,6 @@ jobs:
           set -euo pipefail
           git push --atomic origin "HEAD:refs/heads/main" "refs/tags/v${NEW_NAME}"
 
-      - name: Dispatch release-tag.yml
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -euo pipefail
-          gh workflow run release-tag.yml --ref "v${NEW_NAME}" -f dry_run=false
-
       - name: Write step summary
         run: |
           set -euo pipefail