[codex] add release-plz automation #47
+191
−73
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| name: Release-plz | ||
|
|
||
| on: | ||
| push: | ||
| branches: [master] | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| CARGO_TERM_COLOR: always | ||
|
|
||
| jobs: | ||
| release-plz-release: | ||
| name: Publish crate and create GitHub release | ||
| if: github.repository == 'ScriptedAlchemy/tracedecay' | ||
| runs-on: ubuntu-latest | ||
| environment: crates-io | ||
| permissions: | ||
| contents: write | ||
| pull-requests: read | ||
| id-token: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "22" | ||
| cache: npm | ||
| cache-dependency-path: dashboard/package-lock.json | ||
|
|
||
| - name: Build dashboard assets | ||
| working-directory: dashboard | ||
| run: | | ||
| npm ci | ||
| npm run build | ||
|
|
||
| - uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| - name: Run release-plz release | ||
| uses: release-plz/action@v0.5 | ||
| with: | ||
| command: release | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }} | ||
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | ||
|
|
||
| release-plz-pr: | ||
| name: Open or update release PR | ||
| if: github.repository == 'ScriptedAlchemy/tracedecay' | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| concurrency: | ||
| group: release-plz-${{ github.ref }} | ||
| cancel-in-progress: false | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
|
|
||
| - uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| - name: Run release-plz release-pr | ||
| uses: release-plz/action@v0.5 | ||
| with: | ||
| command: release-pr | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }} | ||
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| # Release Automation | ||
|
|
||
| TraceDecay uses two workflows for stable releases: | ||
|
|
||
| 1. `Release-plz` runs on pushes to `master`. | ||
| - Opens or updates a release PR. | ||
| - Bumps `Cargo.toml` and `Cargo.lock`. | ||
| - Updates `CHANGELOG.md`. | ||
| - Publishes the `tracedecay` crate to crates.io when the release PR is merged. | ||
| - Creates the `vX.Y.Z` tag and GitHub Release. | ||
| 2. `Release` runs after a GitHub Release is published. | ||
| - Builds platform binaries. | ||
| - Uploads release assets. | ||
| - Updates the Homebrew tap, Scoop bucket, and `server.json`. | ||
|
|
||
| `release.yml` intentionally does not run `cargo publish`; crates.io publishing belongs to `release-plz.yml`. | ||
|
|
||
| ## Required GitHub Setup | ||
|
|
||
| Set repository Actions workflow permissions to allow write access: | ||
|
|
||
| ```bash | ||
| gh api \ | ||
| --method PUT \ | ||
| repos/ScriptedAlchemy/tracedecay/actions/permissions/workflow \ | ||
| -f default_workflow_permissions=write \ | ||
| -F can_approve_pull_request_reviews=true | ||
| ``` | ||
|
|
||
| Add these repository secrets: | ||
|
|
||
| - `RELEASE_PLZ_TOKEN`: fine-grained PAT or GitHub App token with read/write `Contents` and `Pull requests` access. This token is important because releases created with the default `GITHUB_TOKEN` do not trigger the follow-up `release.yml` workflow. | ||
| - `CARGO_REGISTRY_TOKEN`: crates.io token with publish access for `tracedecay`. This is used as a bootstrap fallback until crates.io Trusted Publishing is configured after `release-plz.yml` lands on `master`. | ||
| - `TAP_GITHUB_TOKEN`: token that can push to `ScriptedAlchemy/homebrew-tap` and `ScriptedAlchemy/scoop-bucket`. | ||
|
|
||
| ## Crates.io Setup | ||
|
|
||
| The `tracedecay` crate should use crates.io Trusted Publishing once `release-plz.yml` exists on `master`. Configure the trusted publisher as GitHub Actions for `ScriptedAlchemy/tracedecay`, workflow `release-plz.yml`, environment `crates-io`. | ||
|
|
||
| The first version of a crate must exist before trusted publishing can be configured. `tracedecay` already exists on crates.io, so after this PR is merged crates.io can be configured for OIDC publishing and `CARGO_REGISTRY_TOKEN` can be removed from `.github/workflows/release-plz.yml`. | ||
|
|
||
| After that, release-plz detects unpublished changes from crates.io, opens a release PR, and publishes on merge. | ||
|
|
||
| ## Normal Release Flow | ||
|
|
||
| 1. Merge feature/fix PRs into `master`. | ||
| 2. `Release-plz` opens or updates a release PR. | ||
| 3. Review the generated version and changelog. | ||
| 4. Merge the release PR. | ||
| 5. `Release-plz` publishes the crate and creates the GitHub Release. | ||
| 6. The GitHub Release triggers `release.yml`, which builds and uploads binaries and updates package-manager manifests. | ||
|
|
||
| ## Manual Recovery | ||
|
|
||
| If release-plz publishes the crate but the binary artifact workflow does not run, check whether `RELEASE_PLZ_TOKEN` was configured. Then manually dispatch `Release` from the Actions tab against the release tag. | ||
|
There was a problem hiding this comment.
If the follow-up release event is missed, manually dispatching Useful? React with 👍 / 👎. |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| [workspace] | ||
| allow_dirty = true | ||
| dependencies_update = false | ||
| repo_url = "https://github.com/ScriptedAlchemy/tracedecay" | ||
| release_always = false | ||
| git_release_enable = true | ||
| git_release_name = "v{{ version }}" | ||
| git_release_body = "{{ changelog }}" | ||
| git_release_type = "prod" | ||
| git_release_draft = false | ||
| git_release_latest = true | ||
| git_tag_enable = true | ||
| git_tag_name = "v{{ version }}" | ||
| pr_branch_prefix = "release-plz-" | ||
| pr_labels = ["release"] | ||
| publish = true | ||
| publish_allow_dirty = true | ||
| publish_timeout = "1h" | ||
| semver_check = false |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a change only touches tracked dashboard UI sources under
dashboard/*/src/**, this release-pr job will not bump a version because release-plz opens PRs from changed packaged crate files; this crate’s whitelist ships generateddashboard/*/dist/**assets instead, and those files are gitignored/not committed. The release job later builds those assets before publishing, so dashboard-only fixes do affect the published crate but can be stranded with no release PR until some Rust/package file changes.Useful? React with 👍 / 👎.