ci: run CI on PRs only; give release-please a token that may edit wor…

.github/workflows/ci.yml

@@ -3,10 +3,11 @@
 # reusable course-check workflow run against the example course.
 name: CI
 
+# Pull requests only. Branch protection requires PRs to be up to date with
+# main before merging, so the PR run is the run of what lands on main.
 on:
-  push:
-    branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/release.yml

@@ -32,6 +32,11 @@ jobs:
       - id: release
         uses: googleapis/release-please-action@v4
         with:
+          # The default GITHUB_TOKEN cannot commit changes to .github/workflows/
+          # (release-please bumps KIT_VERSION there), and PRs it opens do not
+          # trigger CI. Use a token with Contents, Pull requests and Workflows
+          # write access. See README, "Releasing".
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 

README.md

@@ -132,6 +132,14 @@ One-time setup (after this repo exists as `neuromatch/course-kit`):
    `release`. The first release creates the project.
 3. Create the `release` environment in the repo settings.
 4. Add a second owner/maintainer on npm and PyPI.
+5. Create a fine-grained personal access token (or GitHub App) for this repo
+   with read/write on Contents, Pull requests and Workflows, and save it as
+   the repository secret `RELEASE_PLEASE_TOKEN`. release-please edits
+   `KIT_VERSION` in `.github/workflows/`, which the default `GITHUB_TOKEN`
+   may not do.
+6. Branch protection on `main`: require pull requests, the CI checks, and
+   "Require branches to be up to date before merging". CI runs on pull
+   requests only.
 
 ## License