Repository navigation
Update the release process - #25
Merged
Merged
Conversation
…pp is set up A release starts from the Actions tab (or gh workflow run release.yml) on main. A verify job checks, with no secrets, the version's form, that the commit is on main with test.yml green and no GitHub release yet, that the version stamp matches, and that CHANGELOG.md has a dated section for it. The publish job then waits for an approval on the release environment, creates the annotated tag with the release GitHub App's token (the only bypass the tag ruleset is to have), runs goreleaser, and attests every archive. The App token is scoped to this repository, so one App can serve as the release bot for several. Until the App and the environment exist, a tag pushed with just release still releases, through the same verify job and with no tag to create; a run started by hand without the App fails before publishing and says to use just release. A tag the App pushes is a bot's push and starts no second run. Running the workflow again with an existing tag publishes it with main's workflow, which replaces the tag input #18 added. Also: stale.yml's write permissions move into its job, the Dockerfile's base image is pinned by digest and Dependabot keeps it current, CODEOWNERS sends review requests to salad-cloud-cli-maintainers and CI, release and install files to admins, and AGENTS.md, CONTRIBUTING.md and scripts/release.sh describe both ways in. Needs the release App, the release environment and the salad-cloud-cli-maintainers team set up before the workflow-run path works. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cory-salad
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Releases start from the Actions tab instead of a tag pushed from someone's machine: the workflow verifies the commit,
waits for an approval on the
releaseenvironment, and a release GitHub App creates the tag. Until the App is set up,a tag pushed with
just releasestill releases, through the same checks.Changes
release.yml: averifyjob with no secrets (the version, the commit onmainwithtest.ymlgreen, no existingrelease, the version stamp, the CHANGELOG section) and a
publishjob (approval, the App-created tag, goreleaser,attestations). A pushed tag skips the tag step, a tag pushed by a bot starts no run, and running it again for an
existing tag publishes that tag.
CODEOWNERS,stale.ymlpermissions, the Dockerfile's base image pinned by digest and kept current by Dependabot,and the release docs in
AGENTS.mdandCONTRIBUTING.md.The workflow-run path needs the release App, its client ID and key on the
releaseenvironment, and a tag ruleset thatlets only the App create tags. Limit the environment to
mainat the same time as that ruleset: a pushed tag's rundeploys from the tag.
Checklist
just cipasses (formatting, lint, and the offline tests)docs/(and the README, if install or getting started changed) andCHANGELOG.md(under Unreleased) reflect thechange:
AGENTS.mdandCONTRIBUTING.md; nothing changes for people using the CLI.The workflow first runs after merge; the next
just releaseexercises the pushed-tag path.🤖 Generated with Claude Code