Repository navigation
ci: annotated version marker with evidence dispatch - #21
Merged
Merged
Conversation
When a release PR labeled autorelease: pending merges, create only an annotated git tag from VERSION. Never creates a GitHub Release. Unblocks release-please after skip-github-release leaves merged PRs untagged.
Register .github/workflows/version-marker.yml in REPO_FILE_POLICY allowlists and approved_workflow_sha256; refresh MANIFEST.sha256 and REPO_MANIFEST.json so validate accepts the annotated-tag-only marker.
Move the evidence-only version marker into release-please.yml (the only workflow approved for contents: write). After main pushes, if v\$VERSION is missing, create an annotated tag via the Git API — never a GitHub Release. Removes the standalone version-marker workflow blocked by workflow_controls and personal-contact checks.
Skip tag creation unless the pushed main head message matches chore(main): release *. Prevents later chore merges from claiming the VERSION tag; the current v0.9.4 marker still needs a Founder one-shot at the existing release merge commit.
GITHUB_TOKEN tag creates do not start other workflows' push events. After creating the annotated version tag, explicitly dispatch the existing evidence-only release.yml via workflow_dispatch with tag_name. Add actions: write to release-please only so the dispatch is permitted. release.yml remains contents: read and never creates a GitHub Release.
Bridge-Node-7
changed the title
Bridge-Node-7
marked this pull request as ready for review
November 1, 2026 04:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends
release-please.ymlso that after a release PR merge to main, ifv$VERSIONis missing, it creates an annotated git tag via the Git API and explicitly dispatches the existing evidence-onlyrelease.ymlworkflow.Why
skip-github-release: trueskips tag creation, leaving merged release PRs outstanding. Tags created withGITHUB_TOKENalso do not trigger other workflows'pushevents, so evidence must be dispatched explicitly (see GitHub Actions docs onGITHUB_TOKENand workflow triggers).Safety
release.ymlstayscontents: read).chore(main): release *.actions: writeonly onrelease-please.ymlto allowworkflow_dispatchofrelease.yml.Test plan