From 3896d1e8fd8c20696e4f24025dd2570b9b2e7045 Mon Sep 17 00:00:00 2001
From: Konstantine Tsafatinos <kosta.tsaf@gmail.com>
Date: Mon, 19 Oct 2026 08:18:23 -0400
Subject: [PATCH] ci: run CI on PRs only; give release-please a token that may
 edit workflows

---
 .github/workflows/ci.yml      | 5 +++--
 .github/workflows/release.yml | 5 +++++
 README.md                     | 8 ++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd87808..82cd4d4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,10 +3,11 @@
 # reusable course-check workflow run against the example course.
 name: CI
 
+# Pull requests only. Branch protection requires PRs to be up to date with
+# main before merging, so the PR run is the run of what lands on main.
 on:
-  push:
-    branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 39e56f0..62ffe92 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,6 +32,11 @@ jobs:
       - id: release
         uses: googleapis/release-please-action@v4
         with:
+          # The default GITHUB_TOKEN cannot commit changes to .github/workflows/
+          # (release-please bumps KIT_VERSION there), and PRs it opens do not
+          # trigger CI. Use a token with Contents, Pull requests and Workflows
+          # write access. See README, "Releasing".
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
diff --git a/README.md b/README.md
index 9518c74..3ce5451 100644
--- a/README.md
+++ b/README.md
@@ -132,6 +132,14 @@ One-time setup (after this repo exists as `neuromatch/course-kit`):
    `release`. The first release creates the project.
 3. Create the `release` environment in the repo settings.
 4. Add a second owner/maintainer on npm and PyPI.
+5. Create a fine-grained personal access token (or GitHub App) for this repo
+   with read/write on Contents, Pull requests and Workflows, and save it as
+   the repository secret `RELEASE_PLEASE_TOKEN`. release-please edits
+   `KIT_VERSION` in `.github/workflows/`, which the default `GITHUB_TOKEN`
+   may not do.
+6. Branch protection on `main`: require pull requests, the CI checks, and
+   "Require branches to be up to date before merging". CI runs on pull
+   requests only.
 
 ## License