From 41503062db6f40b39c0b86438b7156a4470dbc92 Mon Sep 17 00:00:00 2001
From: "Wei (Jack) Sun" <weisun@google.com>
Date: Tue, 17 Feb 2026 19:20:56 -0800
Subject: [PATCH] fix(release): configure git identity from RELEASE_PAT in
 finalize

Derive user.name and user.email from the RELEASE_PAT owner via
GitHub API so the last-release-sha commit passes CLA checks.
---
 .github/workflows/release-finalize.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/release-finalize.yml b/.github/workflows/release-finalize.yml
index 57b7d0a..ade58ec 100644
--- a/.github/workflows/release-finalize.yml
+++ b/.github/workflows/release-finalize.yml
@@ -44,6 +44,15 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Extracted version: $VERSION"
 
+      - name: Configure git identity from RELEASE_PAT
+        if: steps.check.outputs.is_release_pr == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+        run: |
+          USER_JSON=$(gh api user)
+          git config user.name "$(echo "$USER_JSON" | jq -r '.login')"
+          git config user.email "$(echo "$USER_JSON" | jq -r '.id')+$(echo "$USER_JSON" | jq -r '.login')@users.noreply.github.com"
+
       - name: Record last-release-sha for release-please
         if: steps.check.outputs.is_release_pr == 'true'
         run: |