Skip to content

ci: add scheduled auto-release workflow - #975

Closed
ralphbean wants to merge 1 commit into
mainfrom
chore/auto-release-workflow
Closed

ci: add scheduled auto-release workflow#975
ralphbean wants to merge 1 commit into
mainfrom
chore/auto-release-workflow

Conversation

@ralphbean

Copy link
Copy Markdown
Member

Summary

  • Adds .github/workflows/auto-release.yml — runs every 4 hours + on workflow_dispatch
  • Scans commits since last semver tag for feat: and fix: prefixes using conventional commits
  • Skips release if only chore/ci/docs/test commits are present
  • Determines semver bump: feat → minor, fix → patch, breaking → minor (pre-1.0)
  • Pushes an annotated tag with grouped feat/fix summary, triggering the existing release.yml → GoReleaser pipeline

Setup required

A repo secret AUTO_RELEASE_TOKEN must be created — a fine-grained PAT with contents: write on this repo. The default GITHUB_TOKEN can't be used because tags it pushes don't trigger other workflows (GitHub anti-cascade rule).

Test plan

  • Create AUTO_RELEASE_TOKEN secret
  • Manual workflow_dispatch run with feat/fix commits since last tag → verify tag is pushed and release.yml triggers
  • Manual run with only chore/docs commits since last tag → verify it skips cleanly

Partial-fix: #710

🤖 Generated with Claude Code

Adds a GitHub Actions workflow that runs every 4 hours (and on
workflow_dispatch) to check for releasable changes on main. It scans
commits since the last semver tag for conventional commit prefixes:

- If any feat commits exist → minor bump
- If only fix commits exist → patch bump
- If only chore/ci/docs/test → skip, no release

The workflow pushes an annotated tag which triggers the existing
release.yml + GoReleaser pipeline. The tag body contains a grouped
summary of feat and fix commits.

Requires an AUTO_RELEASE_TOKEN secret (fine-grained PAT with
contents:write) because tags pushed by the default GITHUB_TOKEN
do not trigger other workflows.

Breaking changes bump minor while pre-1.0, with a comment block
explaining how to shift to major bumps at 1.0.

Partial-fix: #710

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@github-actions

Copy link
Copy Markdown

fullsend review is working on this — view logs

@github-actions

Copy link
Copy Markdown

Site preview

Preview: https://fb167fbf-site.fullsend-ai.workers.dev

Commit: 8e9e6821c66d090e6a6cd9951e74fea67a01fdee

@fullsend-ai-review

Copy link
Copy Markdown

Review: #975

Head SHA: 8e9e682
Timestamp: 2026-05-14T00:00:00Z
Outcome: comment-only

Summary

This PR adds a well-structured scheduled auto-release workflow that scans conventional commits since the last semver tag, computes the appropriate version bump, and pushes an annotated tag to trigger the existing GoReleaser pipeline. The implementation is clean, correctly scoped as a partial fix for #710, and follows repo conventions. No critical or high findings — the notes below are minor robustness improvements worth considering.

Findings

Medium

  • [Correctness] .github/workflows/auto-release.yml:36 — Pre-release tags (e.g. v1.2.3-rc.1) match the grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' pattern and could be selected as the latest tag. The workflow would then bump from a pre-release as if it were a stable release, potentially producing v1.2.4 when the intended v1.2.3 stable was never cut.
    Remediation: Tighten the grep to exclude pre-release suffixes: grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' (anchored end) so only stable tags are considered.

Low

  • [Correctness] .github/workflows/auto-release.yml:126echo "${BODY}" can misinterpret commit messages that start with - (e.g. -n, -e) as echo flags, silently corrupting the tag annotation.
    Remediation: Use printf '%s\n' "${BODY}" > /tmp/tag-body.txt instead.

Info

  • [Intent alignment] .github/workflows/auto-release.yml:8 — The design comment on Define continuous release strategy and policy #710 mentioned "every 4 hours during business hours" but the cron 0 */4 * * * runs 24/7. This is functionally fine (quiet days produce no releases) but diverges from the stated design.

  • [Style/conventions] .github/workflows/auto-release.yml:18actions/checkout@v6.0.2 is pinned to a version tag rather than a commit SHA. SHA pinning is more resilient to supply-chain attacks, though the risk is low for first-party GitHub actions.

Footer

Outcome: comment-only
This review applies to SHA 8e9e6821c66d090e6a6cd9951e74fea67a01fdee. Any push to the PR head clears this review and requires a new evaluation.

@rh-hemartin

Copy link
Copy Markdown
Member

I'm not convinced, our main was broken for some time, and today I can't say that main is in a good state for people to use. Auto-releasing just will create noise under these circumstances.

@ralphbean

Copy link
Copy Markdown
Member Author

Ack, dropping this. Continue conversation at #710 (comment)

@ralphbean ralphbean closed this May 15, 2026
@github-actions
github-actions Bot deleted the chore/auto-release-workflow branch June 14, 2026 07:14
waynesun09 added a commit that referenced this pull request Aug 25, 2026
…ard examples

The guide taught pi as a 350-line parallel walkthrough (hand-rolled
pi-hello harness, own config/profile/policy) written before the runtime
became a per-run choice (#6526) and before the fleet repo carried the pi
plumbing (agents#965/#975). Now there is one flow: the standard fleet
examples, plus a "Choosing the runtime" subsection with --runtime pi on
the same commands, the override precedence table (both runtimes), the
verbatim output of a verified run (fullsend main @ 89bf3b8 against
agents main @ 299f264 on macOS and Fedora — harness-default values print
bare, overrides carry their source), Gemini-on-Vertex selection by model
name, and a compact pi-notes list (build the CLI from main until a
release ships pi; image 0.37+ and the exit-127 preflight symptom;
review/retro single-context; FULLSEND_PI_PROVIDER and the bash
allowlist; fail-closed hooks; --debug='*' and pi-debug.log). The pi
platform notes fold into the existing Platform notes as one bullet per
OS, and docs/runtimes.md points at the new anchor.

Closes #6539

Assisted-by: Claude (code)
Signed-off-by: Wayne Sun <gsun@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Define continuous release strategy and policy

2 participants