ci(release): add release-proposal-dispatch workflow - #280
Open
iunanua wants to merge 9 commits into
Open
Conversation
🎉 All green!🧪 All tests passed 🔗 Commit SHA: 46c0ec4 | Docs | Datadog PR Page | Give us feedback! |
iunanua
force-pushed
the
igor/release-automation-wf
branch
3 times, most recently
from
July 27, 2026 14:59
d189bb6 to
3357d9a
Compare
- add the Release proposal workflow: dispatch -> prepare-release.sh -> signed commit via commit-headless -> PR via octo-sts, with a test-mode fallback (unsigned push, no PR) when no STS token can be minted (e.g. a non-protected branch) - add the self.write.pr STS policy - prepare-release.sh: add --no-codex-check to skip the Codex Findings prompt (used by the workflow) - publish.yaml: resolve the Rust toolchain from Cargo.toml instead of hardcoding it
iunanua
force-pushed
the
igor/release-automation-wf
branch
from
July 27, 2026 15:33
3357d9a to
b7c3680
Compare
iunanua
force-pushed
the
igor/release-automation-wf
branch
2 times, most recently
from
July 28, 2026 13:44
4b6cc18 to
d1e0f0a
Compare
iunanua
force-pushed
the
igor/release-automation-wf
branch
from
July 28, 2026 14:07
d1e0f0a to
6939939
Compare
iunanua
marked this pull request as ready for review
July 29, 2026 08:42
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6939939fe2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
iunanua
marked this pull request as draft
July 29, 2026 09:25
Two paths could finish green without producing a proposal PR: octo-sts failing on a protected branch silently degraded to the unsigned test-run path. Test mode is now gated on the ref being unprotected, and a token failure on a protected ref fails fast, before checkout and the multi-minute prepare step. gh pr create failing was logged and swallowed. It now emits an ::error:: naming both recovery paths and exits non-zero; the tolerated "a PR may already exist" case cannot happen now that the run fails when the proposal branch pre-exists. Also: serialize runs with a concurrency group, so a main proposal and a hotfix proposal cannot resolve versions and push branches at once rename the toolchain pin to RUST_VERSION and record why it sits above the crate's rust-version (cargo-release 1.1.2 needs >= 1.91), dropping the unpinned dtolnay/rust-toolchain@stable action install nightly explicitly with --profile minimal, rather than letting rustup auto-download a full nightly inside the prepare step when prepare-release.sh shells out to cargo +nightly for the rustdoc check stage with git add -A so a file the prepare step creates is committed instead of silently dropped, and log the staged diffstat anchor the ref claim in the self.write.pr STS policy fix a run-on sentence in docs/releasing.md and document the protected-branch token failure there
commit-headless treats head-sha as the expected tip of an existing branch unless create-branch is set. The step before it guarantees the proposal branch does not exist, so the push asserted a tip that cannot exist: the signed path failed on every real run, and only the unsigned test path, which bypassed the action entirely, ever worked. Drop that test path along with the octo-sts continue-on-error fallback. The token is required to push a verified commit and open the PR, so a run that cannot mint one now fails at the first step rather than producing an unsigned branch and no PR. Both the push and the PR step lose their conditionals, leaving a single unconditional path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit-headless treats head-sha as the expected tip of an existing branch unless create-branch is set. The step before it guarantees the proposal branch does not exist, so the push asserted a tip that cannot exist: the signed path failed on every real run, and only the unsigned test path, which bypassed the action entirely, ever worked. Drop that test path along with the octo-sts continue-on-error fallback. The token is required to push a verified commit and open the PR, so a run that cannot mint one now fails at the first step rather than producing an unsigned branch and no PR. Both the push and the PR step lose their conditionals, leaving a single unconditional path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Collaborator
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 886ad6c9f4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…ommit instead of main
iunanua
marked this pull request as ready for review
July 29, 2026 13:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the Release proposal GitHub workflow that drives
scripts/prepare-release.sh(merged in #279), plus its supporting pieces:.github/workflows/release-proposal-dispatch.yaml—workflow_dispatch→ resolve toolchain → installcargo-release/git-cliff→prepare-release.sh→ signed commit viacommit-headless→ PR viaocto-sts..github/workflows/chainguard/self.write.pr.sts.yaml— theself.write.prSTS policy used to mint the PR token.prepare-release.sh— new--no-codex-checkflag (the workflow passes it, since the PR checklist carries the Codex review).How to use
mainwith aversion(minor,patch,major, or an exact0.6.0/0.6.0-rc.1). It opens achore(release): proposal vX.Y.ZPR.main, but set thebase-branchinput to the hotfix line (e.g.hotfix/0.5.x). The STS policy requires a protected branch, so the workflow must always be dispatched frommain;base-branchcontrols what gets checked out and where the PR is targeted.Testing from a non-protected branch
No STS token can be minted off a protected branch, so the workflow falls back to a test run: it pushes the proposal branch unsigned and skips PR creation, logging a
::warning::/::notice::explaining what was skipped. This lets the full prepare → commit → push flow be exercised without signing/PR permissions.Notes
publish.yaml.