Repository navigation
One-click CLI releases, workflow lint, Dependabot auto-merge - #61
Merged
Merged
Conversation
…st-privilege tokens release-cli.yml cuts a release from the Actions tab: run tests, tag main as vX.Y.Z and cli/vX.Y.Z in one run (a tag pushed with GITHUB_TOKEN never starts a workflow, so tag-then-trigger would publish nothing), build with goreleaser, publish, and smoke-test install.sh against the new assets. The cli/ tag is what lets go install .../cli@latest resolve to a release instead of a pseudo-version of main, and version.go now falls back to the embedded module version so that path reports the real version too. goreleaser ignores cli/* when computing the changelog. cli.yml is test-only now. Every workflow declares contents: read and cancels superseded PR runs. lint-workflows.yml runs actionlint on workflow changes. dependabot-auto-merge.yml squash-merges patch/minor bumps after waiting for the PR's other check runs (path-filtered workflows cannot be required checks without blocking PRs that never start them); majors wait for a human. Repo settings applied alongside: squash-only, auto-merge on, delete branch on merge, and a ruleset on main requiring a pull request and blocking force-push and deletion. CONTRIBUTING documents the flow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release CLI workflow (
release-cli.yml). Actions → Release CLI → Run workflow →0.3.0. It runs the Go tests, tags main asv0.3.0andcli/v0.3.0, builds all six binaries with goreleaser, publishes the GitHub release withchecksums.txt, then runscli/install.shagainst the new assets and asserts--versionmatches. Tagging and publishing happen in one run because a tag pushed withGITHUB_TOKENnever triggers another workflow. Pushing av*tag by hand still works; the workflow adds the missingcli/tag.Why the
cli/tag. The Go module lives incli/, sogo install github.com/Tapetide-hq/agentdraft/cli@latestcurrently resolves to a pseudo-version of main and reports0.1.0-dev. Withcli/vX.Y.Ztags it resolves to the release, andversion.gonow falls back to the module version Go embeds, so that install path reports the real version. goreleaser ignorescli/*when picking the previous tag for the changelog.Hardening.
cli.ymlis test-only. Every workflow declarespermissions: contents: readand cancels superseded PR runs.lint-workflows.ymlruns actionlint on workflow changes.Dependabot (
dependabot-auto-merge.yml). Patch and minor bumps are approved and squash-merged after every other check run on the commit succeeds. Majors are left for a human. It polls check runs itself because the CI workflows are path-filtered, and a required check that never starts would block a PR forever.Repo settings applied directly (not in this diff): squash-only merges, auto-merge enabled, delete-branch-on-merge, and a ruleset on
mainthat requires a pull request and blocks force-push and deletion.Tested
actionlintpasses on all eight workflows.go vet,go test,go buildpass incli/; newversion_test.gocovers the build-info fallback.0.3.0after merge.