From 7cefb48974fa1cd3320ccd0fdb33cbd8715a2fa3 Mon Sep 17 00:00:00 2001
From: Stefano Guerrini <stefano@zenrows.com>
Date: Wed, 14 Oct 2026 12:42:19 +0200
Subject: [PATCH] ci(release): run CI on release PRs

Release PRs come from GITHUB_TOKEN, so GitHub starts no workflows on them.
The release workflow now starts CI on each open release PR, so its checks
run before the merge.
---
 .github/workflows/ci.yml      |  2 ++
 .github/workflows/release.yml | 15 +++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76f0302..a6e3ca9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,8 @@
 name: CI
 
 on:
+  # The release workflow starts CI on release PRs, which start no workflows themselves.
+  workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened]
   push:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 508bb1c..45d0043 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,7 @@ jobs:
       group: ${{ github.workflow }}-release-pr
       cancel-in-progress: false
     permissions:
+      actions: write
       contents: write
       pull-requests: write
     steps:
@@ -32,6 +33,20 @@ jobs:
           manifest-file: .release-please-manifest.json
           skip-github-release: true
 
+      # A PR that GITHUB_TOKEN opens starts no workflows, so start CI on each
+      # open release PR here. Its results show on the release PR.
+      - name: Run CI on the release PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh pr list --repo "$GITHUB_REPOSITORY" --state open --author app/github-actions \
+            --label "autorelease: pending" --json headRefName --jq '.[].headRefName' |
+            while read -r branch; do
+              echo "Starting CI on $branch"
+              gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
+            done
+
   detect:
     name: Detect a release
     runs-on: ubuntu-latest