From 31fc99623b45a0c372b6ed2585e18b48cc3f2cf9 Mon Sep 17 00:00:00 2001
From: Ulysse Corbeil <ulysse98@hotmail.com>
Date: Fri, 6 Nov 2026 15:49:32 -0500
Subject: [PATCH] push the release tag with GITHUB_TOKEN and start
 sf-release.yml on the release branch

---
 .github/workflows/sf-release-tag.yml | 13 ++++++++++---
 CHANGELOG.md                         |  4 ++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/sf-release-tag.yml b/.github/workflows/sf-release-tag.yml
index a2ceb11f536..1b7f0fb2536 100644
--- a/.github/workflows/sf-release-tag.yml
+++ b/.github/workflows/sf-release-tag.yml
@@ -10,7 +10,8 @@ on:
       - "CHANGELOG.md"
 
 permissions:
-  contents: read
+  actions: write
+  contents: write
 
 concurrency:
   group: sf-release-tag-${{ github.event.pull_request.number }}
@@ -27,13 +28,11 @@ jobs:
       run:
         shell: bash
     steps:
-      # Pushed with dfuse-bot's token, the tag triggers the branch's workflows like a manual tag does.
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: 0
-          token: ${{ secrets.DFUSE_BOT_TOKEN }}
 
       - name: Install sfreleaser
         run: |
@@ -50,3 +49,11 @@ jobs:
           VERSION: ${{ steps.detect.outputs.version }}
           COMMIT: ${{ github.event.pull_request.merge_commit_sha }}
         run: git push origin "$COMMIT:refs/tags/$VERSION"
+
+      # A tag pushed with GITHUB_TOKEN triggers no workflow, so the release branch (the default one) starts sf-release.yml on it.
+      - name: Start sf-release.yml on the tag
+        if: steps.detect.outputs.is_release_pr && github.base_ref == github.event.repository.default_branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.detect.outputs.version }}
+        run: gh workflow run sf-release.yml --repo "$GITHUB_REPOSITORY" --ref "$VERSION"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9474f0a0d3f..7793e3cfc07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ This changelog covers Firehose-specific changes only. For upstream reth changes,
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## reth-v2.9.0-fh3.1-not-a-real-version-alpha
+
+Tests the automated release tag, no Firehose changes.
+
 ## reth-v2.9.0-fh3.1-2-rc.1
 
 Tests the automated release tag, no Firehose changes.