DL-301

release-please authenticates with a scoped GitHub App installation token (contents + pull-requests, installation-scoped, per-run) so the release-please-opened Release PR receives pull_request CI and branch protection is a real merge gate — a bare GITHUB_TOKEN-opened PR gets none under GitHub’s recursion guard

Status: Active (Matt, 2026-08-25)