Repository navigation
chore: new release processes - #1092
joaodordio wants to merge 6 commits into
Conversation
Replaces the monolithic release workflow with a two-step process: - Prepare Release: bumps version, updates changelog, opens PR, creates GitHub draft release - Publish Release: promotes draft, tags master/main, publishes to distribution, posts Slack Ref: SDK release process team agreement 2026-09-11
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1092 +/- ##
==========================================
- Coverage 73.67% 73.65% -0.02%
==========================================
Files 114 114
Lines 10202 10202
==========================================
- Hits 7516 7514 -2
- Misses 2686 2688 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
This PR does not touch CHANGELOG.md. The body does not contain The rule says that Why it conflicts Suggested action |
… grep
- Add ref: master/main to actions/checkout in all prepare/publish workflows
so workflows always operate on the default branch regardless of dispatch ref
- Replace shell-injection-prone ${{ steps...outputs.notes }} pattern with
--notes-file using $RUNNER_TEMP/release-notes.md (safe from backticks/quotes
in changelog content)
- Treat empty [Unreleased] section as a hard error in prepare-release
- Fix CHANGELOG verification grep: grep -qE "^## \[VERSION\]" (anchored,
prevents substring matches and prefix collisions like 3.1.0 vs 3.1.0-rc1)
Replace SDK_RELEASE_TOKEN (iOS) and GITHUB_TOKEN (all repos) with a short-lived installation token from the iterable-sdk-release GitHub App, generated via actions/create-github-app-token@v1. Benefits: - App token triggers CI on PRs it creates (GITHUB_TOKEN cannot) - 1h TTL vs long-lived PAT - Workflow-scoped permissions so we can push .github/workflows/ files Required credentials (repo variable + secret, or set at org level): vars.ITERABLE_SDK_RELEASE_APP_ID secrets.ITERABLE_SDK_RELEASE_APP_PRIVATE_KEY
|
PR description “Secrets to add” is stale after What the code does: Workflows now require What the spec says: Call out secrets that must exist before the first run. Why it conflicts: A reader following the PR body will miss the App install/credentials, and the first Prepare/Publish will fail at token minting. Suggested action: Update the PR body (and keep |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| exit 1 | ||
| fi | ||
|
|
||
| - uses: ruby/setup-ruby@v1 |
Require dispatch from master, verify draft release state and absent version tag before publish, and reject whitespace-only Unreleased notes.
4ff82f3 to
a756b44
Compare
Add docs_pr input so generated release PRs pass Validate Release PR, pin create-github-app-token, make publish resumable with --clobber and remote tag checks, and handle prereleases without --latest.
On resume, check out refs/tags/<version> and skip xcframework build and upload so assets stay tied to the tagged commit. Set --latest=false when publishing prerelease drafts.
Summary
Replaces the existing ad-hoc release workflows with a standardized two-step process across all SDKs.
No customer facing changes
Workflow 1: Prepare Release (
workflow_dispatch)Inputs:
version,ticket[Unreleased]to new version section)Workflow 2: Publish Release (
workflow_dispatch)Input:
version#eng-sdk-teamon SlackFiles changed
.github/workflows/prepare-release.yml.github/workflows/publish-release.ymlConfiguration required before first run
GitHub App (Prepare and Publish)
ITERABLE_SDK_RELEASE_APP_ID— App ID for theiterable-sdk-releaseGitHub AppITERABLE_SDK_RELEASE_APP_PRIVATE_KEY— PEM private key for the AppInstall the App on this repository with permissions to create PRs, manage releases, and write contents.
Publish Release only
SLACK_WEBHOOK— webhook URL for#eng-sdk-teamnotificationsCOCOAPODS_TRUNK_TOKEN— CocoaPods trunk token forpod_trunk_pushRelated: [SDK Release Process Team Agreement 2026-09-11]
No customer facing changes