ci(release): gate releases on vendor/ sync, add automated bump-version PR flow - #216
Open
felickz wants to merge 1 commit into
Open
ci(release): gate releases on vendor/ sync, add automated bump-version PR flow#216felickz wants to merge 1 commit into
felickz wants to merge 1 commit into
Conversation
…n PR flow Two gaps found while investigating why a manual-release run didn't bump .release.yml/README: - manual-release (workflow_dispatch) tags/publishes off the latest GitHub Release, entirely bypassing .release.yml - there was no automation that ever bumped .release.yml/README.md/ghascompliance/__version__.py. - action.yml runs directly out of the committed vendor/ tree at runtime, so a release cut while vendor/ is out of sync with Pipfile.lock (e.g. a pending vendor-sync PR) would ship stale dependencies. Changes: - Add check-vendor-sync job: regenerates vendor/ and fails auto-release / manual-release if it produces a diff against Pipfile.lock. - Add bump-version job (workflow_dispatch, bump: patch/minor/major): opens a PR bumping .release.yml and every location it tracks via 42ByteLabs/patch-release-me, invoked directly via docker run to avoid a known arg-splitting bug in the wrapping action (upstream #161/#162) that silently downgrades minor/major bumps to patch. Modeled on advanced-security/spdx-dependency-submission-action's release.yml. - manual-release now only fires for an explicit "version" input (ad hoc / pre-release path); bump no longer releases immediately. - Track ghascompliance/__version__.py as a bump location in .release.yml - it was never kept in sync before. - Reconcile .release.yml/README.md/docs/ghascompliance/__version__.py from the stale 2.11.1 to the actual latest published release, 2.12.1. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c448d197-00e8-49b3-9ce6-48b9088db0d0
Contributor
Dependency ReviewThe following issues were found:
License Issues.github/workflows/release.yml
OpenSSF Scorecard
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors the repository’s release automation to (1) make version bumps happen via an automated PR that updates all tracked version locations and (2) gate publishing releases on vendor/ being regenerated cleanly from Pipfile.lock, aligning the release artifact with the repo’s shipped runtime dependencies.
Changes:
- Add a
bump-versionworkflow_dispatch path that runspatch-release-meviadocker runand opens a PR bumping.release.yml+ tracked locations. - Add a
check-vendor-syncjob and make publishing jobs depend on it, failing the release if regeneratingvendor/produces a diff. - Reconcile version references to
2.12.1across.release.yml, docs, README, andghascompliance/__version__.py, and update.release.ymlto trackghascompliance/__version__.py.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/release.yml |
Adds bump-version PR automation and gates publishing paths on a vendor-sync verification job. |
.release.yml |
Updates tracked version to 2.12.1 and adds ghascompliance/__version__.py as a bump target. |
ghascompliance/__version__.py |
Updates the library version constant to 2.12.1. |
README.md |
Updates example action refs / clone commands to v2.12.1. |
docs/introduction/actions.md |
Updates example action refs to v2.12.1. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+128
to
+131
| if: >- | ||
| github.repository == 'advanced-security/policy-as-code' && | ||
| (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.version != '')) | ||
| runs-on: ubuntu-latest |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
While debugging why a
manual-releaserun didn't bump.release.yml/README.md, found two gaps:.release.yml.manual-release(workflow_dispatch) tags/publishes a GitHub Release computed from the latest GitHub Release tag, entirely bypassing.release.yml. Nothing wrote back to.release.yml,README.md, orghascompliance/__version__.py— the only way was a hand edit.advanced-security/spdx-dependency-submission-action'srelease.ymlalready solved this with apatch-release-me-based bump job; this PR ports that pattern here.vendor/.action.ymlruns the action directly out of the committedvendor/tree (PYTHONPATHincludesvendor/), sovendor/is the shipped runtime artifact. IfPipfile.lockmoved onmainbut thevendor-syncPR hasn't merged yet, a release cut in that window would ship mismatched dependencies with nothing catching it.What changed
check-vendor-sync(new job): regeneratesvendor/fromPipfile.lockand fails the run if that produces a diff, beforeauto-release/manual-releasecan publish.bump-version(new job,workflow_dispatchwithbump: patch/minor/major): opens a PR bumping.release.ymland every location it tracks, via42ByteLabs/patch-release-me. Invoked directly viadocker runrather than the wrapping action — that action's own Docker CMD construction mis-splits-m "minor"/-m "major"into a single argv token, soclapcan't parse it and silently falls back to a patch bump (see patch-release-me#161, fix unmerged in #162).reusable-workflows' ownself-release.ymlstill uses the buggy form, so it wasn't safe to copy either.manual-releasenow only fires for an explicitversioninput (the ad hoc/pre-release path).bumpno longer cuts a release immediately — it opens a PR instead, and merging that PR (which touches.release.yml) is what triggersauto-release..release.ymlnow tracksghascompliance/__version__.pyas a bump location — it was never kept in sync before..release.yml/README.md/docs/introduction/actions.md/ghascompliance/__version__.pyfrom the stale2.11.1to the actual latest published release,2.12.1(drift caused by earlier ad hocmanual-releasetest runs during this investigation), so the nextbump-versionPR computes correctly instead of walking versions backward.Follow-up flow going forward
bump: patch|minor|major→ opens a PR bumping.release.yml+ tracked files.auto-releasefires automatically (aftercheck-vendor-syncpasses) → tags + publishes the GitHub Release.versioninput remains for ad hoc/hotfix/pre-release cuts that intentionally bypass.release.yml.Testing
.release.ymland.github/workflows/release.ymlparse as YAML.patch-release-mebug and confirmed viaspdx-dependency-submission-action's workflow andreusable-workflows'self-release.ymlsource.bump-version/check-vendor-synclocally (they needdocker/pipenvin Actions); recommend a maintainer runsbump-versionwithbump: patchonce merged to validate end-to-end before relying on it.