Repository navigation
ci: cut releases from a workflow that runs release.sh - #217
Conversation
Trigger Cut Release with a bump kind; the prepare job runs release.sh prepare and enables auto-merge on the release PR, and merging that PR runs release.sh publish, whose tag push feeds the existing PyPI and GitHub Release workflows. Both jobs act as the automation app so the PR gets checks and the tag triggers publishing.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| - name: Prepare release | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| run: ./scripts/release.sh prepare "${{ inputs.bump }}" |
There was a problem hiding this comment.
nit: Pass inputs.bump through env: instead of expanding it inside run: (not blocking).
The runner substitutes ${{ inputs.bump }} into the shell text before release.sh validates the value. A value such as "; curl ... # runs as shell code with the app token in scope. publish.yml:43 (INPUT_TAG) and regenerate.yml:77 (TITLE) already use the env: pattern.
| run: ./scripts/release.sh prepare "${{ inputs.bump }}" | |
| BUMP: ${{ inputs.bump }} | |
| run: ./scripts/release.sh prepare "$BUMP" |
The suggestion replaces only the run: line. Keep the existing GH_TOKEN line above BUMP in the env: block.
| client-id: Iv23liKBX2RYMoZIYuKa | ||
| private-key: ${{ secrets.HOTDATA_AUTOMATION_PRIVATE_KEY }} | ||
| owner: hotdata-dev | ||
|
|
There was a problem hiding this comment.
nit: The publish job tags the current tip of main, not the release PR's merge commit (not blocking).
release.sh publish runs git checkout "$base" and git pull --ff-only at scripts/release.sh:209-210. If another PR merges after the release PR and before this job runs, vX.Y.Z lands on the later commit. PyPI then ships code that the release PR and its changelog section do not describe.
Fix: after release.sh publish returns, compare git rev-parse HEAD with github.event.pull_request.merge_commit_sha and fail if they differ. A stricter fix is to let publish accept a ref argument and pass the merge commit SHA.
There was a problem hiding this comment.
Correction to the inline comment on cut-release.yml line 107: run the merge-commit check before release.sh publish, not after. After publish returns, the tag is already pushed. Compare git rev-parse origin/main with github.event.pull_request.merge_commit_sha in a step before "Tag and push".
1 participant
Why
scripts/release.sh prepareandpublishwere only ever run from a laptop, which needs a clean checkout,gh,uv, and the right Python. Everything after the tag push already ran in CI.What
cut-release.yml:workflow_dispatchwith abumpinput runsrelease.sh prepareas the Hotdata automation app, then enables squash auto-merge on the release PR. Branch protection gates the merge on checks and the review.release/v*PR, runsrelease.sh publish, which tags main and pushes. The app token is used so the tag push triggerspublish.ymlandrelease.yml.release.sh: PR body and two comments updated to describe the CI path. No logic change.RELEASING.md: the release steps are now onegh workflow runcommand.How to release after this merges