feat(release): release on merge to the trunk, not on a tag

.github/workflows/cla-reusable.yml

@@ -1,6 +1,11 @@
 name: "CLA Assistant (Reusable)"
 on:
   workflow_call:
+    secrets:
+      APP_ID:
+        required: true
+      APP_PRIVATE_KEY:
+        required: true
 
 permissions: {}
 

.github/workflows/crates.yml

@@ -9,11 +9,9 @@ on:
         description: Repository script run before cargo publish. It may append to $GITHUB_ENV.
         type: string
         default: ""
-      environment:
+      version:
+        description: version output of release-check.yml
         type: string
-        default: release
-    secrets:
-      CARGO_REGISTRY_TOKEN:
         required: true
 
 permissions:
@@ -22,7 +20,10 @@ permissions:
 jobs:
   crates:
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.environment }}
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
@@ -31,10 +32,27 @@ jobs:
         with:
           persist-credentials: false
       - run: rustup show active-toolchain || rustup toolchain install
-      - if: inputs.setup-script != ''
+      - id: published
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          crate=$(cargo metadata --no-deps --format-version 1 | jq -r --arg m "$PWD/Cargo.toml" '.packages[] | select(.manifest_path == $m) | .name')
+          if [ -z "$crate" ]; then
+            echo "::error::no [package] in $PWD/Cargo.toml"
+            exit 1
+          fi
+          if curl -sf -o /dev/null -H "User-Agent: $GITHUB_REPOSITORY" "https://crates.io/api/v1/crates/$crate/$VERSION"; then
+            echo "::notice::$crate $VERSION is already on crates.io"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.published.outputs.skip != 'true' && inputs.setup-script != ''
         env:
           SCRIPT: ${{ inputs.setup-script }}
         run: '"./$SCRIPT"'
-      - env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - if: steps.published.outputs.skip != 'true'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - if: steps.published.outputs.skip != 'true'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked

.github/workflows/docker-dev.yml

@@ -0,0 +1,63 @@
+name: Docker dev
+on:
+  workflow_call:
+    inputs:
+      image:
+        description: GHCR repository under ghcr.io, such as blacklanternsecurity/bbot
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  plan:
+    if: github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-24.04
+    outputs:
+      builds: ${{ steps.read.outputs.builds }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
+          path: .shared
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - id: read
+        env:
+          IMAGE: ghcr.io/${{ inputs.image }}
+        run: uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py images "$IMAGE" dev
+
+  build:
+    needs: plan
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        build: ${{ fromJSON(needs.plan.outputs.builds) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ${{ matrix.build.file }}
+          push: true
+          tags: |
+            ${{ matrix.build.ref }}
+            ghcr.io/${{ inputs.image }}:dev-${{ github.sha }}${{ matrix.build.suffix }}
+          cache-from: type=gha,scope=dev-${{ matrix.build.file }}
+          cache-to: type=gha,mode=max,scope=dev-${{ matrix.build.file }}

.github/workflows/docker.yml

@@ -10,9 +10,6 @@ on:
         description: version output of release-check.yml
         type: string
         required: true
-      prerelease:
-        type: string
-        required: true
       major:
         type: string
         required: true
@@ -23,6 +20,13 @@ on:
         description: Push README.md to the Docker Hub repository description
         type: boolean
         default: false
+    secrets:
+      DOCKER_USERNAME:
+        description: Never passed by a caller. The release environment's secret of this name.
+        required: false
+      DOCKER_TOKEN:
+        description: Never passed by a caller. The release environment's secret of this name.
+        required: false
     outputs:
       images:
         description: JSON list of pushed version references, for publish.yml images
@@ -57,11 +61,10 @@ jobs:
   build:
     needs: plan
     runs-on: ubuntu-24.04
+    environment: release
     strategy:
       matrix:
         build: ${{ fromJSON(needs.plan.outputs.builds) }}
-    env:
-      RELEASE: ${{ inputs.prerelease == 'false' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -80,11 +83,10 @@ jobs:
             suffix=${{ matrix.build.suffix }}
           tags: |
             type=raw,value=${{ inputs.version }}
-            type=raw,value=dev,enable=${{ env.RELEASE == 'false' }}
-            type=raw,value=latest,enable=${{ env.RELEASE }}
-            type=raw,value=stable,enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }}.${{ inputs.minor }},enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }},enable=${{ env.RELEASE }}
+            type=raw,value=latest
+            type=raw,value=stable
+            type=raw,value=${{ inputs.major }}.${{ inputs.minor }}
+            type=raw,value=${{ inputs.major }}
       - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
@@ -94,16 +96,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=${{ matrix.build.file }}
           cache-to: type=gha,mode=max,scope=${{ matrix.build.file }}
-
-  description:
-    if: inputs.description
-    needs: build
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+      - if: inputs.description && matrix.build.suffix == ''
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}

.github/workflows/publish.yml

@@ -6,8 +6,8 @@ on:
         description: version output of release-check.yml, which the caller runs first
         type: string
         required: true
-      prerelease:
-        description: prerelease output of release-check.yml
+      tag:
+        description: tag output of release-check.yml. Created here, on the commit being released, after every artifact is published.
         type: string
         required: true
       images:
@@ -38,16 +38,65 @@ on:
       registry-token:
         description: Token for pulling private images; omit for public images
         required: false
+      BLS_RELEASE_PRIVATE_KEY:
+        description: Never passed by a caller. Declared so the release environment's secret of this name resolves.
+        required: false
 
 permissions:
   contents: read
 
 jobs:
+  image-sbom:
+    if: inputs.images != '[]'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        image: ${{ fromJSON(inputs.images) }}
+    steps:
+      - id: name
+        env:
+          IMAGE: ${{ matrix.image }}
+          TAG: ${{ inputs.tag }}
+        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${TAG}.spdx.json" >> "$GITHUB_OUTPUT"
+      - id: auth
+        env:
+          TOKEN: ${{ secrets.registry-token }}
+        run: echo "login=$([ -n "$TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      - if: steps.auth.outputs.login == 'true'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ inputs.registry }}
+          username: ${{ inputs.registry-username }}
+          password: ${{ secrets.registry-token }}
+      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          image: ${{ matrix.image }}
+          format: spdx-json
+          output-file: ${{ steps.name.outputs.file }}
+          upload-artifact: false
+          upload-release-assets: false
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: image-sbom-${{ steps.name.outputs.file }}
+          path: ${{ steps.name.outputs.file }}
+          if-no-files-found: error
+
   release:
+    needs: image-sbom
+    if: ${{ !cancelled() && needs.image-sbom.result != 'failure' }}
     runs-on: ubuntu-24.04
+    environment: release
     permissions:
-      contents: write
+      contents: read
     steps:
+      - id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.BLS_RELEASE_APP_ID }}
+          private-key: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}
+          permission-contents: write
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -63,69 +112,36 @@ jobs:
           pattern: ${{ inputs.artifacts }}
           path: dist
           merge-multiple: true
+      - if: inputs.images != '[]'
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: image-sbom-*
+          path: sbom
+          merge-multiple: true
       - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: .
           format: spdx-json
-          output-file: sbom/${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
+          output-file: sbom/${{ github.event.repository.name }}-${{ inputs.tag }}.spdx.json
           upload-artifact: false
           upload-release-assets: false
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          TAG: ${{ inputs.tag }}
           VERSION: ${{ inputs.version }}
-          PRERELEASE: ${{ inputs.prerelease }}
           CHANGELOG: ${{ inputs.changelog }}
           ASSETS: ${{ inputs.assets }}
         run: |
-          flags=(--verify-tag)
+          flags=(--target "$GITHUB_SHA")
           if [ -n "$CHANGELOG" ]; then
             uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py notes "$CHANGELOG" "$VERSION" > "$RUNNER_TEMP/notes.md"
             flags+=(--notes-file "$RUNNER_TEMP/notes.md")
           else
             flags+=(--generate-notes)
           fi
-          [ "$PRERELEASE" = true ] && flags+=(--prerelease)
           gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || gh release create "$TAG" -R "$GITHUB_REPOSITORY" "${flags[@]}"
           shopt -s globstar nullglob
           files=(sbom/*.spdx.json)
           for asset in $ASSETS; do files+=("$asset"); done
           gh release upload "$TAG" -R "$GITHUB_REPOSITORY" --clobber "${files[@]}"
-
-  image-sbom:
-    if: inputs.images != '[]'
-    needs: release
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-    strategy:
-      matrix:
-        image: ${{ fromJSON(inputs.images) }}
-    steps:
-      - id: name
-        env:
-          IMAGE: ${{ matrix.image }}
-        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${GITHUB_REF_NAME}.spdx.json" >> "$GITHUB_OUTPUT"
-      - id: auth
-        env:
-          TOKEN: ${{ secrets.registry-token }}
-        run: echo "login=$([ -n "$TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-      - if: steps.auth.outputs.login == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ${{ inputs.registry }}
-          username: ${{ inputs.registry-username }}
-          password: ${{ secrets.registry-token }}
-      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
-        with:
-          image: ${{ matrix.image }}
-          format: spdx-json
-          output-file: ${{ steps.name.outputs.file }}
-          upload-artifact: false
-          upload-release-assets: false
-      - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
-          FILE: ${{ steps.name.outputs.file }}
-        run: gh release upload "$TAG" -R "$GITHUB_REPOSITORY" --clobber "$FILE"

.github/workflows/python-tests.yml

@@ -23,7 +23,7 @@ on:
         type: string
         default: "{}"
       secret-env:
-        description: JSON list of caller secret names exported under the same name. Requires secrets inherit.
+        description: JSON list of secret names, each declared below and passed by name, exported under the same name
         type: string
         default: "[]"
       coverage:
@@ -37,6 +37,11 @@ on:
       lint:
         type: boolean
         default: true
+    secrets:
+      CODECOV_TOKEN:
+        required: false
+      BBOT_IO_API_KEY:
+        required: false
     outputs:
       python-versions:
         value: ${{ jobs.matrix.outputs.versions }}