[seant-aws]

What was the problem/requirement? (What/Why)

The OpenJD release train re-releases this repository when an upstream OpenJD package releases (dependency bump, tests, release notes). It runs in AWS without a GitHub credential, so the repository's own workflow makes its GitHub writes.

What was the solution? (How)

.github/workflows/release_train.yml calls the reusable workflow from aws-deadline/.github#130 on a merge to mainline, on completion of Release: Publish, on workflow_dispatch and daily at 06:17 UTC. After a release here it dispatches the release train of aws-deadline/deadline-cloud-worker-agent with a dedicated, bot-owned, Actions-only dispatch token per organization (optional; without one, those repositories' daily run picks the release up). In live mode the train opens bot/* dependency PRs for a maintainer to approve and squash-merge, then dispatches this repository's own Release: Bump.

.github/dependabot.yml ignores openjd-* and auto_approve.yml no longer approves an openjd-* update, so Dependabot does not race the train. With the ignore in place the auto-approve guard is redundant; it stays as a second check.

What is the impact of this change?

None until an admin enables it. The job is skipped unless the variable RELEASE_TRAIN_ENABLED is true. To enable:

• Secret RELEASE_TRAIN_ROLE: the ARN of the train's OIDC role (provided once the role is deployed in the team's account).
• Variables RELEASE_TRAIN_MODE=live and RELEASE_TRAIN_ENABLED=true.
• Add RELEASE_TRAIN_DISPATCH_TOKEN (fine-grained, resource owner OpenJobDescription, repositories openjd-model-for-python, openjd-sessions-for-python and openjd-cli, Actions read/write only) and RELEASE_TRAIN_DISPATCH_TOKEN_AWS_DEADLINE (fine-grained, resource owner aws-deadline, repository deadline-cloud-worker-agent, Actions read/write only) as repository or organization secrets. Both owned by a bot user, 90-day expiry, with a named rotation owner. Optional: without them, downstream repositories are picked up by their daily run.
• Exclude refs/heads/bot/** from the block-branch-creation ruleset.
• Keep "Allow GitHub Actions to create and approve pull requests" on.

This PR depends on aws-deadline/.github#130.

How was this change tested?

actionlint and zizmor 1.32 (pedantic, with the aws-deadline zizmor policy) are clean. The same caller, pointed at fork branches, ran a release end to end on fork repositories, including the downstream dispatch.

Was this change documented?

Yes, in the workflow's header comment.

Is this a breaking change?

No.

Does this change impact security?

The job gets contents, pull-requests and actions write and id-token: write, used only by the reusable workflow's checked actions (bot/* branches only, never repository code). Only the dispatch step receives the dispatch tokens, and it uses each only for repositories of its own organization. The AWS role trusts only this repository's mainline subject; a pull_request run can never assume it.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

Claude review · advisory

Reviewed 5620463 (full review): 0 findings.

Open: 0 blocking · 0 should-fix · 0 nit. ✅ Nothing blocking.

_{Fix or reply to each thread; the next revision's review re-checks open threads and resolves those it agrees are handled. Resolving a thread yourself also closes it. Later revisions review only what changed.}