fix auto release workflow logic for release v2.7.0 #1260
Conversation
WalkthroughThe PR updates two GitHub Actions workflows: one now blocks PRs to main unless sourced from staging; the other reworks the release process to create/update production PRs directly from staging to main, removing release-branch creation and updating messages, checks, and PR body/title accordingly. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant RC as Workflow: release-calendar
participant Repo as Repo (branches)
Dev->>Repo: Push commits to staging
GH-->>RC: Trigger on schedule/dispatch
RC->>Repo: Check for open PR (head=staging, base=main)
alt PR exists
RC->>Repo: Update PR body/title to reflect latest staging
else No PR
RC->>Repo: Create PR (head=staging → base=main)
end
note over RC,Repo: No release branch is created
sequenceDiagram
autonumber
actor User as Contributor
participant GH as GitHub
participant BL as Workflow: block-non-staging-to-main
User->>GH: Open PR to main (head != staging)
GH-->>BL: Trigger on PR to main
BL->>GH: Fail check with message: only staging → main allowed
User->>GH: Open PR to main (head = staging)
GH-->>BL: Pass check
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/release-calendar.yml (2)
359-359: Mitigate moving-target risk: create production PRs as draftSince the PR auto-updates with new staging commits, consider opening it as a draft to avoid approvals becoming stale mid-flight.
gh pr create \ --base main \ - --head staging \ + --head staging \ + --draft \ --title "${TITLE}" \ --label release \ --label automated \ --label production \ --body-file pr_body.md
377-382: Avoid duplicate PRs from race conditions: add workflow concurrencyTwo runs can race between “list” and “create.” Add a concurrency group to serialize production PR creation.
At workflow top-level:
concurrency: group: release-calendar-production cancel-in-progress: falseOptionally scope by day to allow staging job concurrently:
concurrency: group: release-calendar-${{ github.workflow }}-${{ github.job }} cancel-in-progress: false
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/block-non-dev-to-main.yml(2 hunks).github/workflows/release-calendar.yml(4 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
.github/workflows/**/*.{yml,yaml}: In GitHub workflows, use the shared composite actions in .github/actions for dependency caching instead of calling actions/cache directly
Use the cache-yarn composite action for Yarn dependency caching in workflows
Use the cache-bundler composite action for Ruby gems caching in workflows
Use the cache-gradle composite action for Gradle caching in workflows
Use the cache-pods composite action for CocoaPods caching in workflows
Files:
.github/workflows/block-non-dev-to-main.yml.github/workflows/release-calendar.yml
🪛 actionlint (1.7.7)
.github/workflows/block-non-dev-to-main.yml
12-12: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions for more details
(expression)
🔇 Additional comments (2)
.github/workflows/release-calendar.yml (2)
6-9: Docs match new flow (staging → main).Comment updates accurately reflect the new process.
Also applies to: 12-12, 17-17
291-293: Existing PR check is correct for direct staging → main flowQuerying --base main --head staging prevents duplicate PRs from this repo’s staging branch.
If you sometimes open PRs from forks, confirm you don’t need user:staging in the head filter.
| - name: Block PRs not from staging | ||
| run: | | ||
| if [[ "${{ github.head_ref }}" != "dev" ]]; then | ||
| echo "You can only merge from dev to main." | ||
| if [[ "${{ github.head_ref }}" != "staging" ]]; then | ||
| echo "You can only merge from staging to main." | ||
| exit 1 |
There was a problem hiding this comment.
Harden PR source check: avoid inlining untrusted github.head_ref in shell
Using ${{ github.head_ref }} directly inside the script risks shell injection. Prefer step-level if or pass via env var and quote.
Option A (recommended): use step-level condition to fail cleanly
- - name: Block PRs not from staging
- run: |
- if [[ "${{ github.head_ref }}" != "staging" ]]; then
- echo "You can only merge from staging to main."
- exit 1
- fi
+ - name: Block PRs not from staging
+ if: ${{ github.event.pull_request.head.ref != 'staging' }}
+ run: |
+ echo "You can only merge from staging to main."
+ exit 1Option B: pass through environment and enforce bash
- - name: Block PRs not from staging
- run: |
- if [[ "${{ github.head_ref }}" != "staging" ]]; then
- echo "You can only merge from staging to main."
- exit 1
- fi
+ - name: Block PRs not from staging
+ env:
+ HEAD_REF: ${{ github.head_ref }}
+ shell: bash
+ run: |
+ if [[ "$HEAD_REF" != "staging" ]]; then
+ echo "You can only merge from staging to main."
+ exit 1
+ fiBased on static analysis hints
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Block PRs not from staging | |
| run: | | |
| if [[ "${{ github.head_ref }}" != "dev" ]]; then | |
| echo "You can only merge from dev to main." | |
| if [[ "${{ github.head_ref }}" != "staging" ]]; then | |
| echo "You can only merge from staging to main." | |
| exit 1 | |
| - name: Block PRs not from staging | |
| if: ${{ github.event.pull_request.head.ref != 'staging' }} | |
| run: | | |
| echo "You can only merge from staging to main." | |
| exit 1 |
🧰 Tools
🪛 actionlint (1.7.7)
12-12: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions for more details
(expression)
🤖 Prompt for AI Agents
.github/workflows/block-non-dev-to-main.yml around lines 11-15: the workflow
inlines the untrusted github.head_ref into a shell block which can lead to shell
injection; replace this by using a step-level condition (preferred) that checks
github.head_ref != 'staging' to fail the job without running a shell, or if you
must run a script, pass github.head_ref into the step via an env variable and
reference it safely (e.g., ENV_VAR="${{ github.head_ref }}" then use
double-quoted "$ENV_VAR") and ensure the step uses bash (shell: bash) so quoting
is respected; update the step to either use if: ${{ github.head_ref != 'staging'
}} with a clear error message or move the check into a bash script that reads a
quoted env var.
transphorm
deleted the
justin/fix-staging-to-main-release-pr-allow-main-prs
branch
Summary by CodeRabbit