From 3df5bd75fcc11a732c615974fb7b04a167cd9674 Mon Sep 17 00:00:00 2001
From: pwadmore-ea <8915039+pwadmore-ea@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:16:51 +0100
Subject: [PATCH 1/3] fix/FSR-1701-merge-to-development-then-release

https://eaflood.atlassian.net/browse/FSR-1701

From bcf67e0ab7c707c7600fa58a397d25b29522a283 Mon Sep 17 00:00:00 2001
From: pwadmore-ea <8915039+pwadmore-ea@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:37:16 +0100
Subject: [PATCH 2/3] Release after development merge. Use GITHUB_TOKEN

---
 .github/workflows/merge.yml | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index 3be23e17f..e11f5916e 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -16,13 +16,6 @@ jobs:
       - name: Display inputs
         run: echo "${{ github.event.inputs.version }}"
 
-      - name: Check PAT token is still valid
-        run: |
-          gh workflow list --repo "$GITHUB_REPOSITORY_OWNER/flood-service"
-        env:
-          # if this fails the create/regenerate classic PAT and then populate it using `gh secret set GH_WORKFLOW`
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
-
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1
         with:
@@ -65,8 +58,7 @@ jobs:
             prCheck flood-service master
             prCheck flood-service development
         env:
-          # create classic PAT and then run `gh secret set GH_WORKFLOW`
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
         run: npm ci --engine-strict --ignore-scripts
@@ -80,20 +72,18 @@ jobs:
           git merge --no-edit $RELEASE_BRANCH
           git push origin master
 
-      - name: Create GitHub Release
-        run: gh release create $TAG_VERSION --title "Release $VERSION" --notes "[release notes](/$RELEASE_NOTES_FILE)"
-        env:
-          # create classic PAT and then run `gh secret set GH_WORKFLOW`
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
-
       - name: Merge release branch into development
         run: |
           git switch development
           git merge --no-edit $RELEASE_BRANCH
           git push origin development
 
+      - name: Create GitHub Release
+        run: gh release create $TAG_VERSION --title "Release $VERSION" --notes "[release notes](/$RELEASE_NOTES_FILE)"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Trigger Merge Release Branch for flood-service
         run: gh workflow run --repo  "$GITHUB_REPOSITORY_OWNER/flood-service" merge.yml -f version="$VERSION"
         env:
-          # use PAT token with repo scope (github.token didn't work)
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From debc0397388a2f09f0bb52f2eef7e6a28b921b55 Mon Sep 17 00:00:00 2001
From: pwadmore-ea <8915039+pwadmore-ea@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:44:01 +0100
Subject: [PATCH 3/3] Use GITHUB_TOKEN

---
 .github/workflows/release.yml | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 459b2e913..0a4c85b25 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,13 +32,6 @@ jobs:
       - name: Display inputs
         run: echo "${{ github.event.inputs.jira_release_id }} ${{ github.event.inputs.increment }} ${{ github.event.inputs.db_changes }} ${{ github.event.inputs.proposed_release_date }}"
 
-      - name: Check PAT token is still valid
-        run: |
-          gh workflow list --repo "$GITHUB_REPOSITORY_OWNER/flood-service"
-        env:
-          # if this fails the create/regenerate classic PAT and then populate it using `gh secret set GH_WORKFLOW`
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
-
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1
         with:
@@ -109,14 +102,12 @@ jobs:
           gh pr create --base master --title "Release $VERSION" --body "TBC"
           gh pr create --base development --title "Release $VERSION"  --body "TBC"
         env:
-          # create classic PAT and then run `gh secret set GH_WORKFLOW`
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Trigger release creation for flood-service
         run: gh workflow run --repo "$GITHUB_REPOSITORY_OWNER/flood-service" release.yml -f increment="${{ github.event.inputs.increment }}" -f proposed_release_date="${{ github.event.inputs.proposed_release_date }}" -f jira_release_id="${{ github.event.inputs.jira_release_id }}"
         env:
-          # use PAT token with repo scope (github.token didn't work)
-          GH_TOKEN: ${{ secrets.GH_WORKFLOW }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Clean up
         if: ${{ failure() }}