From 42ffd2f343686a927e33ffd2fe369200afd3ff49 Mon Sep 17 00:00:00 2001
From: Anuj Singh <60409639+singholt@users.noreply.github.com>
Date: Mon, 13 Apr 2026 16:50:38 -0700
Subject: [PATCH] Fix release workflow branch handling and add GitHub App token

- Use 'git fetch origin' instead of 'git fetch origin dev:dev' to avoid
  errors when a local branch already exists or is checked out
- Create staging branch from current HEAD instead of origin/dev, allowing
  the workflow to use whichever branch is selected in the GitHub UI
- Use origin/master and origin/dev remote refs in changelog script instead
  of local branch names
- Remove stderr suppression in changelog script for easier debugging
- Add GitHub App token generation for PR creation
---
 .github/workflows/create-release-pr.yml | 17 +++++++++++------
 scripts/generate-release-changelog.sh   |  6 +++---
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index 136f7d36642..d8cc5c1450f 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -42,16 +42,14 @@ jobs:
           fi
           echo "Release v${AGENT_VERSION} does not exist. Proceeding."
 
-      - name: Fetch dev branch
+      - name: Fetch latest remote refs
         run: |
-          git fetch origin dev:dev
+          git fetch origin
 
       - name: Create staging branch
         run: |
           BRANCH_NAME="v${AGENT_VERSION}-stage"
-          git checkout -b "$BRANCH_NAME" origin/dev
-          COMMIT_SHA=$(git rev-parse HEAD)
-          echo "Staging branch: $BRANCH_NAME at $COMMIT_SHA"
+          git checkout -b "$BRANCH_NAME"
           echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
 
       - name: Generate changelog
@@ -139,6 +137,13 @@ jobs:
           git config user.email "amazon-ecs-bot@amazon.com"
           git commit -m "Release ${AGENT_VERSION}"
 
+      - name: Generate App Token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Push staging branch to origin
         run: |
           echo "Pushing branch ${BRANCH_NAME} to origin..."
@@ -146,7 +151,7 @@ jobs:
 
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ secrets.ECS_AGENT_WORKFLOW_SECRET }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           PR_BODY=$(cat <<EOF
           ### Summary
diff --git a/scripts/generate-release-changelog.sh b/scripts/generate-release-changelog.sh
index 2a20075d012..7ac4433c8a5 100755
--- a/scripts/generate-release-changelog.sh
+++ b/scripts/generate-release-changelog.sh
@@ -20,8 +20,8 @@ set -e
 OUTPUT_FILE="CHANGELOG.md"
 REPO_OWNER="aws"
 REPO_NAME="amazon-ecs-agent"
-BASE_BRANCH="master"
-DEV_BRANCH="dev"
+BASE_BRANCH="origin/master"
+DEV_BRANCH="origin/dev"
 AGENT_VERSION=""
 
 # Global arrays to store changelog entries by category
@@ -136,7 +136,7 @@ get_release_changes() {
 	local commits
 
 	# Exclude merge commits using --no-merges
-	commits=$(git log ${BASE_BRANCH}..${DEV_BRANCH} --no-merges --format=%H 2>/dev/null)
+	commits=$(git log ${BASE_BRANCH}..${DEV_BRANCH} --no-merges --format=%H)
 
 	if [ $? -ne 0 ]; then
 		log_error "Failed to get commits. Make sure you're in a git repository and both ${BASE_BRANCH} and ${DEV_BRANCH} branches exist"