fix(release): open release PRs with a real identity so their CI runs

[rubenvdlinde]

GitHub withholds workflow triggering from GITHUB_TOKEN to prevent recursion, so a pull request opened with it gets no checks at all.

This workflow already knew. The block above the bump step measures the cost — openregister#2817 merged with 4 check-runs where neighbouring PRs had 45, roughly 15 such merges fleet-wide on 2026-08-24 — and responded by bounding what the bump may contain, because calling quality.yml from here would check out the integration branch and report a green describing a different commit.

Opening the PR with the org PAT removes the cause instead, and without that objection: we are not calling quality.yml with the wrong ref, we are letting the normal pull_request trigger fire on the pull request's own commit.

What prompted it

Measured 2026-08-30: 38 release runs sat at action_required across hermiq (17), zaakafhandelapp (14) and opencatalogi (7), waiting for an approval nobody was coming to give.

That state also disguises itself. action_required reports as status=completed, so a "recent completions" query returns a wall of them and looks like CI has died — it hasn't; those runs never started.

The change

Both PR-opening steps now use secrets.FLEET_DISPATCH_TOKEN. Get merged PR labels keeps github.token, since it only reads.

The fallback is deliberate, and loud. A secret that does not exist expands to the empty string, and an empty GH_TOKEN would break release PR creation fleet-wide. So the step keeps working and emits a ::warning:: naming exactly what was lost:

FLEET_DISPATCH_TOKEN is not set here. Opening this pull request with GITHUB_TOKEN, so its checks will NOT run and it can merge unverified.

Degrading to the unverified path in silence is the failure this change exists to end. I could not verify the secret exists — listing org secrets needs admin:org, which this account lacks — so the fallback is doing real work rather than being defensive decoration.

Verification

• YAML parses.
• The inserted guard is valid bash, exercised both ways: warns and continues when absent, silent when present, and does not trip set -e.
• Callers already use secrets: inherit, so an org-level secret reaches the reusable workflow.

🤖 Generated with Claude Code