From 32dd3af8f4c555a0319ff4663a54e9d43b35179f Mon Sep 17 00:00:00 2001
From: Sean Tang <171081544+seant-aws@users.noreply.github.com>
Date: Thu, 5 Nov 2026 18:55:54 +0000
Subject: [PATCH 1/2] ci: add the OpenJD release train workflow

The caller of aws-deadline/.github's reusable release-train workflow, inert until the RELEASE_TRAIN_ENABLED variable is true. Dependabot no longer proposes openjd-* updates and the auto-approve job skips them: the release train owns those bumps.

Signed-off-by: Sean Tang <171081544+seant-aws@users.noreply.github.com>
---
 .github/dependabot.yml              |  4 ++
 .github/workflows/auto_approve.yml  |  2 +
 .github/workflows/release_train.yml | 60 +++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 .github/workflows/release_train.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a5b4595..eb17c36 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,10 @@ updates:
       day: "monday"
     commit-message: 
       prefix: "chore(deps):"
+    ignore:
+      # The OpenJD release train bumps the openjd-* packages itself (release_train.yml), with its tests and
+      # release notes; a Dependabot PR for them would race it.
+      - dependency-name: "openjd-*"
     # Combine all minor and patch bumps into a single PR. Major bumps do not
     # match this group and so each get their own individual PR.
     groups:
diff --git a/.github/workflows/auto_approve.yml b/.github/workflows/auto_approve.yml
index b4838ce..1d0c33e 100644
--- a/.github/workflows/auto_approve.yml
+++ b/.github/workflows/auto_approve.yml
@@ -15,6 +15,8 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Approve a PR
+        # Never an openjd-* update: the release train owns those bumps (dependabot.yml ignores them).
+        if: ${{ !contains(steps.metadata.outputs.dependency-names, 'openjd-') }}
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/release_train.yml b/.github/workflows/release_train.yml
new file mode 100644
index 0000000..d99b7e9
--- /dev/null
+++ b/.github/workflows/release_train.yml
@@ -0,0 +1,60 @@
+# The OpenJD release train for this repository. The train runs in AWS and holds no GitHub credential: this
+# workflow asks it what to do (start a train for a new upstream release, push a bot/* branch, open its PR,
+# notice a merge, dispatch Release: Bump) and does the GitHub writes with this job's GITHUB_TOKEN. All the logic
+# and its checks live in the reusable workflow; this caller only sets the triggers and forwards the variables
+# and secrets.
+#
+# Inert until an admin sets the variable RELEASE_TRAIN_ENABLED=true (the job is skipped otherwise).
+# RELEASE_TRAIN_MODE names the train's mode, the secret RELEASE_TRAIN_ROLE the AWS role that may invoke the
+# train's gateway.
+#
+# A PR the train opens has its CI held until a maintainer approves the run; review and squash-merge it as
+# usual. The merge (a push to the default branch) runs this workflow, which tells the train.
+#
+# What runs it: a merge pushes, the repository's own "Release: Publish" completing, an upstream repository's
+# run after its release (workflow_dispatch), and a person (workflow_dispatch). A run that started or advanced
+# a train waits for the train's next step. The daily schedule is the backstop for an event that went missing.
+name: Release train
+
+on:
+  schedule:
+    # Daily backstop, off the hour.
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+  push:
+    # The default branch: a merged bot PR is reported right away instead of on the next schedule.
+    branches: [mainline]
+  # A release: the train sees it without waiting for the schedule. The run is only a signal: it runs this file
+  # from the default branch with the default branch's OIDC subject, and the reusable workflow reads nothing of
+  # the run that triggered it (no artifact, head ref or event payload).
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["Release: Publish"]
+    types: [completed]
+
+# One run at a time per repository; a run that finds nothing to do takes a few seconds.
+concurrency:
+  group: release-train
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  train:
+    if: ${{ vars.RELEASE_TRAIN_ENABLED == 'true' }}
+    # Our own reusable workflow, referenced by branch like every aws-deadline/.github workflow (the
+    # aws-deadline zizmor policy allows that ref pin for aws-deadline/*).
+    uses: aws-deadline/.github/.github/workflows/reusable_release_train.yml@mainline
+    permissions:
+      contents: write # push bot/* branches; create tags and releases (rehearsal only)
+      pull-requests: write # open and update the train's PRs and their labels
+      actions: write # dispatch this repository's own Release: Bump (live mode)
+      id-token: write # OIDC tokens for the AWS role and the gateway
+    with:
+      mode: ${{ vars.RELEASE_TRAIN_MODE }}
+      # The repositories this one may start after a release (also on the train's own allowlist).
+      dispatch_repos: "aws-deadline/deadline-cloud-worker-agent"
+    secrets:
+      role_arn: ${{ secrets.RELEASE_TRAIN_ROLE }}
+      # The release workflows' token, used only by the dispatch step to run release_train.yml in
+      # dispatch_repos. Optional: without it those repositories' daily run picks a release up.
+      dispatch_token: ${{ secrets.CI_TOKEN }}

From 562046352a02cd59b561439877500bba496c1d07 Mon Sep 17 00:00:00 2001
From: Sean Tang <171081544+seant-aws@users.noreply.github.com>
Date: Thu, 5 Nov 2026 20:45:01 +0000
Subject: [PATCH 2/2] ci: dispatch downstream release trains with one bot-owned
 token per organization

Pass RELEASE_TRAIN_DISPATCH_TOKEN (OpenJobDescription repositories) and RELEASE_TRAIN_DISPATCH_TOKEN_AWS_DEADLINE (aws-deadline repositories) to the reusable workflow's per-organization dispatch secrets, in place of the release workflows' token. Both are optional; without one, that organization's downstream repositories pick a release up on their daily run.

Signed-off-by: Sean Tang <171081544+seant-aws@users.noreply.github.com>
---
 .github/workflows/release_train.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release_train.yml b/.github/workflows/release_train.yml
index d99b7e9..56b7d4b 100644
--- a/.github/workflows/release_train.yml
+++ b/.github/workflows/release_train.yml
@@ -55,6 +55,8 @@ jobs:
       dispatch_repos: "aws-deadline/deadline-cloud-worker-agent"
     secrets:
       role_arn: ${{ secrets.RELEASE_TRAIN_ROLE }}
-      # The release workflows' token, used only by the dispatch step to run release_train.yml in
-      # dispatch_repos. Optional: without it those repositories' daily run picks a release up.
-      dispatch_token: ${{ secrets.CI_TOKEN }}
+      # Bot-owned, Actions-only dispatch tokens, one per organization, used only by the dispatch step to run
+      # release_train.yml in dispatch_repos. Optional: without an organization's token its repositories pick a
+      # release up on their daily run.
+      dispatch_token_openjd: ${{ secrets.RELEASE_TRAIN_DISPATCH_TOKEN }}
+      dispatch_token_aws_deadline: ${{ secrets.RELEASE_TRAIN_DISPATCH_TOKEN_AWS_DEADLINE }}