fix(ci): release from the dispatched branch instead of a branch input - #1675
Merged
Conversation
A reusable workflow's job definition (including the node-version test matrix) is always read from the same git ref as the caller, not from the checked-out code. So passing a 'branch' input could only change which code was tested, never which matrix ran -- releasing v4.x from master would still test against master's node versions and miss v4.x-only versions (18.x/20.x). Drive the release off github.ref_name so the branch being released is the ref the workflow runs on: its own shared-ci matrix and jobs apply. Remove the misleading 'branch' input from both prod-release and shared-ci. shared-ci now checks out the triggering ref by default (PR merge ref for CI, dispatched branch for release). Publish checks out by branch name so it includes the version-bump commit pushed by the version job. To release a branch, dispatch the Release workflow from that branch.
1 task
There was a problem hiding this comment.
Pull request overview
This PR updates the release and shared CI reusable workflows so they operate on the ref that triggered the run (e.g., the workflow-dispatched release branch), keeping the checked-out code aligned with the reusable workflow definition and its test matrix.
Changes:
- Remove the
branchworkflow input and stop explicitly checking outinputs.branchin the shared reusable CI workflow. - In the production release workflow, switch from a
branchinput to usinggithub.ref_namefor selecting the branch to release from. - Add clarifying comments explaining why the workflow should run/release from the dispatched ref.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/shared-ci.yml | Removes branch input usage and relies on the triggering ref for checkout to keep tests aligned to the workflow’s branch. |
| .github/workflows/prod-release.yml | Releases from the dispatched ref (github.ref_name) and ensures publish checks out the branch name to pick up the version-bump commit. |
Comments suppressed due to low confidence (1)
.github/workflows/shared-ci.yml:9
- Removing the
branchinput from this reusable workflow will break existing callers that still passwith: branch: ...(GitHub rejects unexpected inputs forworkflow_call). For example,.github/workflows/ci.ymlcurrently calls this workflow withwith: branch: ${{ inputs.branch || 'master' }}.
Either update all call sites in the same PR, or keep a deprecated branch input here (even if it is ignored) to maintain compatibility.
inputs:
test-published-packages:
description: 'Test against published packages instead of checked out code'
required: false
type: boolean
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
75
to
79
| env: | ||
| BRANCH: ${{ github.event.inputs.branch }} | ||
| BRANCH: ${{ github.ref_name }} | ||
| run: | | ||
| git config --global user.name "aws-crypto-tools-ci-bot" | ||
| git config --global user.email "no-reply@noemail.local" |
ci.yml forwards `branch` to shared-ci.yml, but that input was just removed, so the reusable-workflow call failed at startup on every pull_request run. Re-add `branch` as optional (default empty = the triggering ref) and forward it from ci.yml without the `|| 'master'` fallback. PR CI now checks out the PR ref instead of master, release still uses the dispatched ref, and daily CI can still target the v4.x maintenance branch.
The workflow ref is the only branch selector. Remove the branch input from ci.yml and shared-ci.yml so checkout always uses the triggering ref, keeping tested code and the reusable-workflow matrix on the same branch. Guard the release against non-branch dispatch (lerna version pushes to the branch head).
kessplas
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
Description of changes:
Remove the
branchinput from workflows.Before, the src/test code from
branchwould be checked out, but NOT the test environments configured onbranch. This led to a weird case where I was trying to release frombranch=v4.xfrom the master branch. ESDK JS 4.x supports node <22 but 5.x doesn't; master doesn't test against <22 since it's a 5.x branch.Now, release always runs from the branch configured in the release workflow run. (This is also simpler, Kess and I were confused by this distinction earlier)
(Should also note that the "must release from a branch" (versus releasing from a specific commit) requirement was implicit, but is now explicit. In the release workflow the CI bot pushes a changelog commit, which would fail if it checked out a commit rather than a branch.)
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Check any applicable: