From aa4e5b24285af29ad81f30b715c1859b5d78a980 Mon Sep 17 00:00:00 2001
From: Jade Guiton <jade.guiton@datadoghq.com>
Date: Thu, 12 Dec 2024 20:34:51 +0100
Subject: [PATCH] [chore] Fix "Prepare Release" action (#11849)

#### Description

The "Prepare Release" action failed during the latest release process,
as the OpenTelemetry Bot, which opens the release PR, does not have the
permissions to add the new `release:merge-freeze` label. This PR fixes
this by creating the PR with the bot token, then adding the label
separately using the regular CI token.

Since we already use default CI tokens on -contrib to add labels, I
assume they have the permission to do that on this repo as well. I
deemed this simpler than the alternative solutions mentioned in the
tracking issue, though I'm not certain it will work.

Note that the tracking issue is a release blocker.

#### Link to tracking issue
Fixes #11808

#### Testing
I'm not sure how I could test this without getting it merged first
unfortunately. Once merged, we could try running the action, then
closing the resulting PR and issue.
---
 .github/workflows/prepare-release.yml                |  3 ++-
 .github/workflows/scripts/release-prepare-release.sh | 10 +++++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 2e4685566bb..f0640c7d61d 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -101,7 +101,8 @@ jobs:
       #   - Run make prepare-release PREVIOUS_VERSION=0.52.0 RELEASE_CANDIDATE=0.53.0 MODSET=beta
       - name: Prepare release for core
         env:
-          GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
+          BOT_GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPO: open-telemetry/opentelemetry-collector
           CANDIDATE_BETA: ${{ inputs.candidate-beta }}
           CANDIDATE_STABLE: ${{ inputs.candidate-stable }}
diff --git a/.github/workflows/scripts/release-prepare-release.sh b/.github/workflows/scripts/release-prepare-release.sh
index d3e7e1a72ea..e3438ec5950 100755
--- a/.github/workflows/scripts/release-prepare-release.sh
+++ b/.github/workflows/scripts/release-prepare-release.sh
@@ -41,8 +41,12 @@ if [ "${CANDIDATE_BETA}" != "" ]; then
 fi
 git push origin "${BRANCH}"
 
-# The `release:merge-freeze` label will cause the `check-merge-freeze` workflow to fail, enforcing the freeze.
-gh pr create --title "[chore] Prepare release ${RELEASE_VERSION}" --label release:merge-freeze --body "
+# Use OpenTelemetryBot account to create PR, allowing workflows to run
+PR=$(GITHUB_TOKEN="$BOT_GITHUB_TOKEN" gh pr create --title "[chore] Prepare release ${RELEASE_VERSION}" --body "
 The following commands were run to prepare this release:
 ${COMMANDS}
-"
+")
+
+# The `release:merge-freeze` label will cause the `check-merge-freeze` workflow to fail, enforcing the freeze.
+# The bot does not have permissions to add labels, so this is done using the CI action token.
+gh pr edit "$PR" --add-label release:merge-freeze || echo "Failed to add merge-freeze label"