ci: keep EKSCTLBOT_TOKEN out of the release-notes rendering job

.github/workflows/release-drafter.yaml

@@ -10,15 +10,22 @@ permissions:
   contents: read
 
 jobs:
-  update_release_draft:
+  # Renders the draft release notes. This job handles the drafter output, so it
+  # deliberately does not have access to EKSCTLBOT_TOKEN -- it hands the
+  # rendered files to update_release_draft_pr via an artifact instead.
+  render_release_draft:
     if: github.event.repository.fork == false
     permissions:
       # write permission is required to create a github release
       contents: write
-      pull-requests: write
+      # release-drafter only needs to read merged pull requests; the autolabeler
+      # that would require write is not configured in .github/release-drafter.yml.
+      pull-requests: read
     runs-on: ubuntu-latest
+    outputs:
+      tag_name: ${{ steps.draft.outputs.tag_name }}
     steps:
-      # Drafts your next Release notes as Pull Requests are merged into "master"
+      # Drafts your next Release notes as Pull Requests are merged into "main"
       - name: Draft release notes
         id: draft
         uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 #v7.7.0
@@ -30,40 +37,65 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           commitish: main
+      - name: Render release notes and pull request body
+        env:
+          TAG_NAME: ${{ steps.draft.outputs.tag_name }}
+          RELEASE_BODY: ${{ steps.draft.outputs.body }}
+        run: |
+          mkdir -p "${RUNNER_TEMP}/notes"
+          printf '%s\n' "$RELEASE_BODY" > "${RUNNER_TEMP}/notes/${TAG_NAME#v}.md"
+          {
+            printf '🤖 Copy release notes from Draft\n\n'
+            printf '<details>\n'
+            printf '<summary> Full draft release notes for %s </summary>\n' "$TAG_NAME"
+            printf '<blockquote>\n\n'
+            printf '%s\n' "$RELEASE_BODY"
+            printf '\n</blockquote>\n'
+            printf '</details>\n'
+            printf '<br />\n\n'
+            printf 'Auto-generated by [eksctl Draft Release Notes GitHub workflow][1]\n\n'
+            printf '[1]: https://github.com/eksctl-io/eksctl/blob/main/.github/workflows/release-drafter.yaml\n'
+          } > "${RUNNER_TEMP}/notes/pull-request-body.md"
+      - name: Upload rendered notes
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: release-notes
+          path: ${{ runner.temp }}/notes/
+          retention-days: 1
+
+  # Commits the rendered notes and opens the pull request. This is the only job
+  # that holds EKSCTLBOT_TOKEN, and it treats the drafter output purely as file
+  # content -- it never interpolates it into a run step.
+  update_release_draft_pr:
+    needs: render_release_draft
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    env:
+      TAG_NAME: ${{ needs.render_release_draft.outputs.tag_name }}
+    steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           # The Upsert pull request step below authenticates with its own token,
           # so there is no need to leave a credential behind in the git config.
           persist-credentials: false
+      - name: Download rendered notes
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+        with:
+          name: release-notes
+          path: ${{ runner.temp }}/notes
       - name: Copy release notes from Draft
-        env:
-          TAG_NAME: ${{ steps.draft.outputs.tag_name }}
-          RELEASE_BODY: ${{ steps.draft.outputs.body }}
         run: |
-          printf '%s\n' "$RELEASE_BODY" > "docs/release_notes/${TAG_NAME#v}.md"
+          cp "${RUNNER_TEMP}/notes/${TAG_NAME#v}.md" "docs/release_notes/${TAG_NAME#v}.md"
       - name: Upsert pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #v8.1.1
         with:
           token: ${{ secrets.EKSCTLBOT_TOKEN }}
-          commit-message: Add release notes for ${{ steps.draft.outputs.tag_name }}
+          commit-message: Add release notes for ${{ needs.render_release_draft.outputs.tag_name }}
           committer: eksctl-bot <eksctl-bot@users.noreply.github.com>
-          body: |
-            🤖 Copy release notes from Draft
-
-            <details>
-            <summary> Full draft release notes for ${{ steps.draft.outputs.tag_name }} </summary>
-            <blockquote>
-
-            ${{ steps.draft.outputs.body }}
-
-            </blockquote>
-            </details>
-            <br />
-
-            Auto-generated by [eksctl Draft Release Notes GitHub workflow][1]
-
-            [1]: https://github.com/eksctl-io/eksctl/blob/main/.github/workflows/release-drafter.yaml
-          title: 'Add release notes for ${{ steps.draft.outputs.tag_name }}'
+          body-path: ${{ runner.temp }}/notes/pull-request-body.md
+          title: 'Add release notes for ${{ needs.render_release_draft.outputs.tag_name }}'
           labels: kind/improvement, skip-release-notes
           branch: update-release-notes
+          add-paths: docs/release_notes