fix(ci): land release version-bump via PR to satisfy main's branch ruleset - #161
Conversation
The release workflow now references the correct artifact path for the built binaries, ensuring the release step can locate and upload the files successfully. This fixes a failure that occurred when the artifact naming convention was changed in a previous update. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a GitHub Actions workflow to automate the release process, ensuring consistent and repeatable releases are triggered on push to the main branch. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Updated the GitHub Actions release workflow to use the latest versions of checkout and setup-node actions, ensuring compatibility with current runner environments and avoiding deprecation warnings. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
Warning Review limit reached
On-demand reviews are free for the next 21 days. After that, they cost $0.25 per reviewed file. Or wait 20 minutes for your next included review. View limit detailsLimit details: You’ve used all 2 included reviews currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Warning Your free Security trial is over. An organization admin can activate Security or dismiss this notice. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
The release workflow was attempting to merge pull requests with the --squash flag, but the repository only allows merge commits. Changed the merge strategy to --merge so that the release PR can be merged successfully. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 57d046b723
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| git add Cargo.toml Cargo.lock | ||
| git commit -m "Release ${RELEASE_TAG}" | ||
| git tag -a "${RELEASE_TAG}" -m "Release ${RELEASE_TAG}" | ||
| git push origin "${release_branch}" |
There was a problem hiding this comment.
If any step fails after this push but before the PR is merged—for example, packaging or a transient gh pr create failure—the remote release/vX.Y.Z branch remains while main retains the old version. A rerun therefore computes the same branch name, creates a new commit with a different timestamp/SHA, and fails here with a non-fast-forward rejection, requiring manual branch deletion before the release can be retried. Delete or safely replace a stale unmerged release branch, or make the branch name unique per run.
Useful? React with 👍 / 👎.
| git fetch origin "${GITHUB_REF_NAME}" | ||
| merge_sha="$(git rev-parse "origin/${GITHUB_REF_NAME}")" | ||
| echo "sha=${merge_sha}" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
When another PR lands between the release PR merge and this fetch, origin/main points at that later commit, so the workflow tags unrelated post-release changes rather than the squash commit produced for this release; the crate is still published from the local release branch, making the tag and published source disagree. The gh pr merge documentation confirms that --squash merges the PR into the base branch, so obtain that PR's mergeCommit SHA directly instead of sampling the moving branch head.
Useful? React with 👍 / 👎.
1 participant
Summary
Run 33328547070 (re-triggered after #160 merged) failed at the Push release commit and tag step, not at packaging:
#160's fix (gating
cargo package/cargo publishon the resolvedpublishfield) worked exactly as intended — the "Check crates.io publishability" step correctly detectedpublish = falseand cleanly skippedPackage crate/Publish to crates.io(see the run's::notice::annotation). So this is a different, later failure:maincarries a repository ruleset ("Protect main branch") requiring all changes to go through a pull request, and the workflow'sGITHUB_TOKENis not on that ruleset's bypass list (only thegitbook-comGitHub App and theAdminteam can bypass it).git push origin HEAD:mainis therefore always rejected, regardless of the crates.io gating.Root cause
release.yml'sPush release commit and tagstep tried togit push origin HEAD:${GITHUB_REF_NAME}directly againstmain, which the branch ruleset (pull_requestrule type,required_approving_review_count: 0,allowed_merge_methods: ["squash"], no bypass for Actions) always rejects.Fix
Per current guidance, crates.io publishing is no longer wanted at all (consumers now depend on these crates via git/GitHub links), so packaging/publishing stay skipped — that part already worked. For landing the version bump on
main:Commit version bumpnow commits to a throwawayrelease/vX.Y.Zbranch and pushes that branch (notmain— branches other thanmainaren't covered by the ruleset).Open and merge release PRstep opens a PR from that branch intomainand merges it with--squash(the ruleset's only allowed merge method, with 0 required approvals and no required status checks, so this merges immediately with no human action needed), then resolves the resulting merge-commit SHA.Tag and push releasenow tags that merge-commit SHA (not the pre-merge local commit, since squash produces a new SHA) and pushes the tag — tag pushes aren't covered by the ruleset either, so this step is unchanged from before.pull-requests: writeto the workflow'spermissionsblock soGITHUB_TOKENcan create/merge the PR.Was a version or tag already burned?
No.
git ls-remote --tags upstreamshows nov*tags exist yet, andupstream/main's last 5 commits are just the #160 merge and unrelated dependabot bumps — noRelease vX.Y.Zcommit landed. The failed run aborted (bash -e) on the first of the two push commands, so the tag push never even ran.Cargo.tomlonmainis still at0.1.1, so the nextCompute next versionrun will compute0.1.2cleanly with no collision.Local verification
python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))"— parses cleanly.bash -nagainst each new/changed shell snippet (commit step, PR-open-and-merge step, tag step) — no syntax errors.cargo metadata --no-deps --format-version 1 | jq '.packages[] | select(.name=="tinycortex") | .publish'— still[], confirming the crates.io skip path is untouched and still triggers.gh api repos/tinyhumansai/tinycortex/rulesets/13733828that the "Protect main branch" ruleset ispull_request(squash-only, 0 approvals, no bypass for the default Actions token) — the PR+squash-merge approach satisfies it without needing any bypass token or new secret.Refs: run 33328547070, #160.