Stop bumping the version in release.yml — read it, never write it - #26
Merged
Conversation
…to main The second real Release run got past the (now-fixed) keystore issue but failed at "Commit version bump" with GH006: Protected branch update failed for refs/heads/main — main requires pull requests, and the workflow's default GITHUB_TOKEN has no bypass for that (unlike the repo owner merging PRs by hand). Confirmed there's no ruleset and no "Lock branch" rule involved, just "Require a pull request before merging". release.yml now opens a small chore(release): vX.Y.Z branch/PR against main and merges it (approve + squash --auto) using the workflow's own token, instead of pushing directly — no branch-protection bypass or PAT needed, just the "Allow GitHub Actions to create and approve pull requests" repo setting that's already been turned on. If the merge can't be automated (e.g. repo-wide auto-merge is off, or required checks are still pending), the step only warns and moves on: the GitHub Release, APK, and Pages deploy don't depend on the PR having landed, only on the build already on disk. Documented the mechanism and the two repo settings it relies on in docs/android/BUILD.md, and updated the STATUS.md loose end to reflect both real failures hit so far and their fixes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WH1WrPxkRsDyMo76MPn3Us
The PR-based version bump from the previous commit worked but was more machinery than the problem needed: pull-requests: write, two extra repo settings (Allow GitHub Actions to create and approve pull requests, Allow auto-merge), and a non-fatal fallback for when those aren't configured just right. Comparing against github.com/Marcogn/ThePatientGamerHelper's release.yml — a sibling project's already-working release pipeline, with the same kind of branch protection on main — showed a simpler fix: that workflow never bumps anything, it only reads versionName from an already-merged build.gradle.kts and refuses to overwrite an existing release. Applied the same pattern here. release.yml now reads package.json's "version" directly (no workflow input anymore) and fails outright if a GitHub Release for that version already exists, instead of silently no-op'ing. Bumping the version is now an entirely normal, human-reviewed PR like any other change — the release workflow only ever reads what's already on main, so it never touches branch protection at all, and pull-requests: write is dropped from its permissions. Android's versionName/versionCode are still patched from the same version, just locally in the build checkout, never committed. Updated CLAUDE.md, docs/DEVELOPMENT.md, docs/android/BUILD.md, and docs/STATUS.md to match — including that "trigger release.yml as a Pages-only redeploy trick" no longer works now that it refuses to run for an already-released version (use the manual deploy steps instead). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WH1WrPxkRsDyMo76MPn3Us
Marcogn
changed the title
Marcogn
marked this pull request as ready for review
August 17, 2026 11:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed (updated — see below for how this PR evolved)
Current state:
release.ymlno longer writes the release version anywhere. It readspackage.json's"version"field directly, refuses to run if a GitHub Release for that version already exists, and otherwise builds/publishes exactly as before. Bumping the version is now an ordinary, human-reviewed PR like any other change to this repo (bumppackage.json, add the matchingCHANGELOG.mdentry, merge it) —release.ymlnever touchesmain, so it never runs into branch protection at all.How this PR got here
base64: invalid input(the actual first failure hit in production — theANDROID_KEYSTORE_BASE64secret's stored value wasn't valid base64).main(GH006: Protected branch update failed, "Require a pull request before merging"). Fixed by havingrelease.ymlopen and auto-merge a smallchore(release): vX.Y.ZPR instead of pushing directly.ThePatientGamerHelper, which has the same kind of branch protection onmainand an already-workingrelease.yml— showed a simpler fix. That workflow never bumps its own version; it only readsversionNamefrom an already-mergedbuild.gradle.ktsand refuses to overwrite an existing release. Applied the same pattern here:release.ymlno longer needspull-requests: write, doesn't depend on "Allow auto-merge" being enabled, and never has to deal with branch protection because it never writes to the protected branch in the first place.Why
Per your report that release kept failing on "something else" each time — each commit in this PR fixes the specific next thing that broke on a real run against
1.0.0, ending with a fundamentally simpler design (read-only version) instead of working around branch protection with increasingly more moving parts.Test plan
yaml.safe_load.run:step in the finalrelease.ymlchecked individually withbash -n(syntax only).sedversion-sync commands against the realandroid/app/build.gradlelocally (correctversionCode/versionNameoutput, file left unchanged afterward — this step never commits).npm run test— unaffected, still 175 passing (workflow/docs-only change).Next step (for you, not this PR)
package.json's"version"is already1.0.0onmain, andCHANGELOG.mdalready has its[1.0.0]entry — nothing to bump for the first release. Re-run theReleaseworkflow once more; it should now get all the way through.