From 059d773b7d62fa7c29821672dbb1a7e7443294b7 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 18 May 2026 13:40:04 -0500
Subject: [PATCH] fix(ci): restore softprops release step and wire rc_notes
 output id

Previous attempts to switch to gh release create or github.token both
hit 403 due to org policy forcing default_workflow_permissions=read.
softprops/action-gh-release@v3 with the app token is the only approach
that has worked successfully. Restore that pattern and wire the
rc_notes step id so its body output can be used by softprops.

The sed fix (strip -rc.N from first line) is preserved.
---
 .github/workflows/promote-release.yml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml
index 30be2e05a..b7ad31f50 100644
--- a/.github/workflows/promote-release.yml
+++ b/.github/workflows/promote-release.yml
@@ -65,26 +65,26 @@ jobs:
           echo "Stable tag: $STABLE_TAG at commit: $COMMIT_SHA"
 
       - name: fetch RC release notes
+        id: rc_notes
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           RC_TAG: ${{ inputs.rc_tag }}
         run: |
           BODY=$(gh release view "$RC_TAG" --json body -q .body)
-          # Strip -rc.N suffix from the version string in the first line header
           BODY=$(echo "$BODY" | sed "1s/-rc\.[0-9]*//" )
-          echo "$BODY" > /tmp/release-notes.md
+          { echo "body<<EOF"; echo "$BODY"; echo "EOF"; } >> "$GITHUB_OUTPUT"
 
       - name: create stable release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          STABLE_TAG: ${{ steps.version.outputs.stable_tag }}
-          COMMIT_SHA: ${{ steps.version.outputs.commit_sha }}
-        run: |
-          gh release create "$STABLE_TAG" \
-            --target "$COMMIT_SHA" \
-            --title "$STABLE_TAG" \
-            --notes-file /tmp/release-notes.md \
-            --latest
+        uses: softprops/action-gh-release@v3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          tag_name: ${{ steps.version.outputs.stable_tag }}
+          target_commitish: ${{ steps.version.outputs.commit_sha }}
+          name: ${{ steps.version.outputs.stable_tag }}
+          body: ${{ steps.rc_notes.outputs.body }}
+          draft: false
+          prerelease: false
+          make_latest: true
 
       - name: trigger full rebuild
         env: