Skip to content

ci(release): never release the template itself, guard the trigger #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cuioss-oliver merged 2 commits into from
Sep 24, 2026
Merged

ci(release): never release the template itself, guard the trigger #145

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea12207
ci(release): never release the template itself, guard the trigger
cuioss-oliver Sep 24, 2026
a6af3cc
ci(release): state that workflow_dispatch bypasses the guard
cuioss-oliver Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,41 @@
# Example: Copy this to your repo as .github/workflows/release.yml
# Configuration is read from .github/project.yml - no inputs needed!
#
# MERGING A CHANGE OF release.current-version IN .github/project.yml IS A RELEASE.
# The central guard inside reusable-maven-release.yml publishes to Maven Central whenever
# current-version differs from the merge commit's first parent and is untagged. Every other
# project.yml edit reaches this workflow too (paths: is only a prefilter) and is refused there.
# plan-marshall-mcp 0.1.0 was published by accident exactly this way: its bootstrap PR moved the
# template's current-version while customizing. Change current-version only through the release
# runbook (.claude/skills/release/SKILL.md).
#
# workflow_dispatch is NOT guarded: the central guard proceeds unconditionally on a dispatch, including
# an unchanged or already-tagged version. It is the deliberate fallback path (and the path of a derived
# repository's first release); the runbook's pre-cut checks are the only gate there.
name: Release

on:
workflow_dispatch:
# PREFILTER ONLY, NEVER THE DECISION. `branches:` is the PR's base: only merges into main may ask.
pull_request:
types: [closed]
paths:
- '.github/project.yml'
workflow_dispatch:
branches: [main]
paths: ['.github/project.yml']

permissions:
contents: read

jobs:
release:
if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
# ANDed with the central guard, never an alternative to it:
# 1. The template repository itself never releases. Repositories created from it carry this
# line unchanged and are unaffected. customize.sh deliberately does NOT rewrite this file:
# renaming the literal below to the new repository would disable its releases.
# 2. A dispatch (which takes no branch filter) runs from main only.
# 3. A PR closed without merging never releases.
if: >-
github.repository != 'cuioss/cui-java-module-template' &&
(github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main') &&
(github.event_name != 'pull_request' || github.event.pull_request.merged == true)
permissions:
contents: write
uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-release.yml@2fa5476de3435e7fc3705646c3f1f3c99be95e71 # v0.30.0
Expand All @@ -25,4 +46,3 @@ jobs:
OSS_SONATYPE_PASSWORD: ${{ secrets.OSS_SONATYPE_PASSWORD }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
PAGES_DEPLOY_TOKEN: ${{ secrets.PAGES_DEPLOY_TOKEN }}
Loading