Release workflow - #43
Closed
carolsimone wants to merge 4 commits into
Closed
Conversation
Mirrors continuo's release.yml, stripped to what actually applies here: no Helm chart, no Kubernetes deploy dir, no self-hosted runner or kind cluster in this repo, so none of retag-images/install-test/publish-chart/ smoke-published-chart exist. publish-pypi.yml and images.yml already do the real publishing work independently, each on their own push:tags trigger — this workflow's only job is to create the GitHub Release once both have succeeded for the tagged commit, since a tag also ships two ghcr.io images that PyPI's own release list knows nothing about. Triggered by the same tag push as its two siblings rather than by workflow_run watching them complete, since `needs:` cannot cross workflow files and this avoids relying on workflow_run's head_branch semantics for a tag-triggered source run. Instead it polls the Actions API for the sibling runs at this commit (event=push, to not pick up one of images.yml's pull_request runs) until both report a conclusion, exits non-zero on any non-success conclusion, and times out after 30 minutes per sibling. -test tags are excluded (TestPyPI dry run, no public Release). Release creation itself is idempotent (create-or-edit), matching continuo's approach; no CHANGELOG.md exists in this repo so notes are always --generate-notes. Verified: YAML validates (python3 -c "import yaml; yaml.safe_load(...)"). NOT verified: the actual cross-workflow wait/poll behavior, which needs a real tag push to exercise — there is no way to integration-test this locally or in a PR. Signed-off-by: Simone Carolini <simonecarolini.sc@gmail.com>
-f/-F on `gh api` switches the request to POST unless overridden — this listing endpoint only accepts GET, so the poll would 404 on its very first call under `set -e` and abort the job every time, regardless of whether publish-pypi.yml/images.yml actually succeeded. Verified against this repo's real API: the -f form 404s, the URL-query-string form returns real run data (tested against main's actual security.yml/ci.yml runs, both "success"). Also raised the job's timeout-minutes from 40 to 70: the two sequential wait_for calls can themselves take up to 30 minutes each — 60 minutes worst case on the polling math alone, before the siblings' own run time — so 40 could never actually cover it. Signed-off-by: Simone Carolini <simonecarolini.sc@gmail.com>
Backfilled from actual tag history (0.1.0 through 0.3.0, plus what's pending for 0.3.1), Keep a Changelog style. release.yml now extracts the section matching the pushed tag's version and uses it as the Release body, falling back to GitHub's generated notes if a tag has no matching section, instead of always using generated notes. Verified the extraction awk script against the real file for 0.3.1/0.3.0/0.2.1 (all extract correctly) and a nonexistent version (correctly falls through to the no-match branch). CONTRIBUTING.md now says where release notes come from, so the file doesn't silently go stale. Signed-off-by: Simone Carolini <simonecarolini.sc@gmail.com>
ci failed: CHANGELOG.md's 0.3.0 entry names continuo-validation-contract, the package that release actually replaced — the same reason docs/superpowers/'s dated design records are already exempt from this sweep (test_no_legacy_names.py's own words: rewriting them "would falsify the design history"). Extended the existing EXEMPT_PREFIXES mechanism rather than reword the changelog entry to dance around the name of what it's describing. Signed-off-by: Simone Carolini <simonecarolini.sc@gmail.com>
Owner
Author
|
Closing as already merged. Every change on this branch landed on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Closes #
Why
How it was verified
Checklist
git commit -s) — thedcocheck enforces thisuv run ruff check .anduv run mypy(relevant packages) passscripts/security-scan.shpasses (dependency or credential-adjacent changes)