ci: create release pull requests - #98
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #98 +/- ##
=======================================
Coverage 94.77% 94.77%
=======================================
Files 21 21
Lines 4251 4251
Branches 1238 1238
=======================================
Hits 4029 4029
Misses 222 222
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9676c3f539
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| VERSION: ${{ steps.version.outputs.version }} | ||
| BRANCH: ${{ steps.version.outputs.branch }} |
There was a problem hiding this comment.
Because gh pr create authenticates with the repository GITHUB_TOKEN, GitHub suppresses workflow runs caused by the resulting pull_request event. Consequently, these automated version PRs do not run .github/workflows/ci-pr.yml or .github/workflows/e2e.yml; required checks may leave the PR unmergeable, or it may be merged without the repository's required patch-coverage validation. Use a GitHub App/PAT that can trigger workflows or explicitly dispatch the required checks.
AGENTS.md reference: AGENTS.md:L30-L33
Useful? React with 👍 / 👎.
| echo "tags<<EOF" >> "$GITHUB_OUTPUT" | ||
| printf '%s\n' "${IMAGE}:${VERSION}-${{ matrix.arch }}" "${IMAGE}:latest-${{ matrix.arch }}" >> "$GITHUB_OUTPUT" | ||
| echo EOF >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
When DOCKERHUB_USERNAME and DOCKERHUB_PASSWORD are configured, releases previously logged in to Docker Hub and published both architecture-specific tags and merged ${VERSION}/latest manifests there. The rewritten tag step now emits only GHCR tags and all Docker Hub manifest creation was removed, so existing Docker Hub users will silently remain on stale images after the next release.
Useful? React with 👍 / 👎.
| lower_owner="$(printf '%s' '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" | ||
| echo "owner=$lower_owner" >> "$GITHUB_OUTPUT" | ||
| version="$(node -p "require('./package.json').version")" | ||
| release_pr="$(gh api --paginate "/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" --jq '.[] | select(.base.ref == "main" and (.title | startswith("chore: prepare release v")) and (.head.ref | startswith("release/v"))) | .number' | head -n 1 || true)" |
There was a problem hiding this comment.
If the GitHub API returns an authentication, rate-limit, network, or server error while processing a merged release PR, the blanket || true converts that failure into an empty release_pr. Lines 78-80 then report should_release=false, leaving the one-time push workflow green while permanently skipping image and GitHub release publication; only a successful empty response should be treated as a non-release push.
Useful? React with 👍 / 👎.
| git commit -m "chore: prepare release v${version}" | ||
| git push --set-upstream origin "$branch" |
There was a problem hiding this comment.
When this workflow is dispatched again while the generated version PR is still open, main still has the old version, so the job creates the same release/v${version} branch locally with a new commit and attempts to push it. That push is non-fast-forward and fails before the open-PR check at lines 55-56 can run, making retries and duplicate dispatches fail despite the apparent idempotency guard; perform the check before creating or pushing the branch.
Useful? React with 👍 / 👎.
1 participant
Prevent release automation from pushing directly to protected main. Manual release dispatch now opens a labeled version PR; merging that PR triggers verification, image publishing, and the GitHub release.