ops: add RELEASE_PLEASE_TOKEN secret for release-please PR creation

[noa-lucent]

Context

• We merged CI and release automation (PR chore: release-please automation + release artifacts + CI #5) and switched Release Please to googleapis action with PAT support (PR chore(release-please): use googleapis action + PAT secret #6).
• Release Please failed due to org policy blocking GITHUB_TOKEN from creating PRs. The workflow now requires a repo secret RELEASE_PLEASE_TOKEN.

Action required

• Create a fine‑grained personal access token (PAT) from our bot/service account scoped to this repo and add it as a repo secret named RELEASE_PLEASE_TOKEN.

Required permissions (fine‑grained PAT)

• Contents: Read/Write
• Pull requests: Read/Write

Acceptance

• Secret RELEASE_PLEASE_TOKEN exists in repo settings → Secrets and variables → Actions.
• Re-run the "Release Please" workflow on main and it successfully opens/updates the Release PR.

Notes

• After the Release PR is opened, we will merge it to tag vX.Y.Z and automatically trigger the Release workflow to build/upload multi-arch artifacts.
• Security: Use a bot account and least-privilege fine‑grained PAT limited to this repository.

[noa-lucent]

Post-PAT release validation checklist (codex-tools-mcp)

Assumption: RELEASE_PLEASE_TOKEN is added (fine-grained PAT) with Contents: RW, Pull requests: RW.

1. Release Please PR opens

• UI: Pull requests → filter label: autorelease: pending → open PR.
  • Title like: chore(main): release X.Y.Z
  • Body: generated notes per Conventional Commits
• Files changed:
  • Cargo.toml: version bumped to X.Y.Z
  • CHANGELOG.md: updated with X.Y.Z section
• CLI (optional):
  • gh pr list --label "autorelease: pending"
  • gh pr diff --name-only | grep -E "Cargo.toml|CHANGELOG.md"

AC: One Release Please PR exists with proper title/label; Cargo.toml + CHANGELOG updated.

2. Tag + Release after merge

• Merge the Release Please PR.
• UI: Code → Tags: vX.Y.Z exists. Releases: vX.Y.Z published (not draft).
• CLI: gh release view vX.Y.Z

AC: Tag vX.Y.Z and a published GitHub Release exist.

3. Release workflow run

• UI: Actions → Release → run triggered by event "release" for vX.Y.Z; all jobs green.
• CLI: gh run list --workflow "Release" --event release | head -n1; gh run view <RUN_ID>

AC: Release workflow completes successfully.

4. Artifacts and checksums

• UI: Releases → vX.Y.Z → Assets contain:
  • codex-tools-mcp_X.Y.Z_linux_amd64.tar.gz
  • codex-tools-mcp_X.Y.Z_linux_arm64.tar.gz
  • codex-tools-mcp_X.Y.Z_darwin_amd64.tar.gz
  • codex-tools-mcp_X.Y.Z_darwin_arm64.tar.gz
  • codex-tools-mcp_X.Y.Z_windows_amd64.zip
  • SHA256SUMS.txt
• Packaging expectations:
  • tar.gz (Unix): binary + README.md + LICENSE (if present), binary is executable
  • zip (Windows): .exe + README.md + LICENSE (if present)
• Checksum (optional local):
  • gh release download vX.Y.Z --pattern "codex-tools-mcp_*" --dir /tmp/codex-tools-mcp
  • gh release download vX.Y.Z --pattern "SHA256SUMS.txt" --dir /tmp/codex-tools-mcp
  • cd /tmp/codex-tools-mcp && sha256sum -c SHA256SUMS.txt

AC: All 5 platform archives + SHA256SUMS.txt present; filenames match pattern; checksums pass.

5. Toolchain/runners

• Logs show Rust 1.90.0 across jobs.
• linux/arm64 uses cross 0.2.5.
• macOS runners: macos-13 (amd64) and macos-14 (arm64).

6. Publisher step

• Attach assets to Release job uses softprops/action-gh-release@v2 with fail_on_unmatched_files: true and permissions contents: write; upload succeeds.

Common failure modes

• Missing PAT secret → Release Please fails at early check. Fix: add RELEASE_PLEASE_TOKEN.
• No Release Please PR → ensure workflow ran on push to main or trigger manually.
• Release workflow not triggered → ensure a GitHub Release is published (not just a tag).
• Asset upload "No files matched" → verify filenames under dist/ match pattern and that download-artifact merged outputs.
• cross/QEMU issues on linux/arm64 → confirm cross 0.2.5 installed; consider adding docker/setup-qemu-action if emulation needed.
• --locked lockfile errors → update Cargo.lock on main before release.

Once PAT is added, I’ll run through this checklist and report results.

[noa-lucent]

Closing: Release Please now uses GITHUB_TOKEN (Option B) and successfully created/merged the v0.1.0 Release PR; release workflow uploaded assets without a PAT. PAT path is no longer needed.