DRIVERS-3601 Add a unified release workflow with semver tagging and GitHub Releases - #115
DRIVERS-3601 Add a unified release workflow with semver tagging and GitHub Releases#115blink1073 wants to merge 12 commits into
Conversation
- Replace delete-then-recreate v3 tag handling with force-tag + force-push to avoid a window where the remote v3 tag is deleted but recreation can fail (local v3 already exists due to fetch-depth: 0), which would leave v3 consumers broken. - Capture next-version.sh stderr separately and surface it in the job summary so the bootstrap-mode notice (major bump silently ignored when no vX.Y.Z tags exist yet) is visible to the operator.
|
Semgrep found 3 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. 🛟 Help? Slack #semgrep-help or go/semgrep-help. Resolution Options:
|
There was a problem hiding this comment.
Pull request overview
Adds a unified, dispatchable release workflow that computes the next semver version, optionally bumps the major-version file, creates signed tags, and publishes a GitHub Release—replacing the older floating-tag-only workflow and documenting the v3→v4 floating-tag change for consumers.
Changes:
- Introduces
.github/workflows/release.ymlto drive semver tagging + GitHub Releases with adry_runmode and optional floatingv3tag update. - Retires
.github/workflows/update-action-tag.ymlin favor of a single release entrypoint. - Adds bash scripts + CI tests to compute the next version and bump the major-version file; updates docs to reflect the new process and tagging policy.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents floating major tag policy through v3 and immutable semver tags starting v4. |
| CONTRIBUTING.md | Updates contributor release instructions to use the new Release workflow. |
| .github/workflows/update-action-tag.yml | Removes the legacy floating-tag update workflow. |
| .github/workflows/release.yml | Adds the unified release workflow: version calculation, optional major bump, signed tags, and GitHub Release creation. |
| .github/workflows/ci.yml | Adds CI job to run tests for the new release scripts. |
| .github/scripts/next-version.sh | Implements next semver computation based on existing tags (with bootstrap from floating major tag). |
| .github/scripts/next-version.test.sh | Adds tests for next-version logic (bootstrap, patch/minor/major, sorting, invalid input). |
| .github/scripts/bump-major-version.sh | Writes the major component of a semver version into version.txt (or provided file). |
| .github/scripts/bump-major-version.test.sh | Adds tests for bump-major-version behavior and error handling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
# Conflicts: # .github/workflows/ci.yml
Summary
release.ymlworkflow that bumps the version (patch/minor/major), creates a signed release tag, and publishes a GitHub Release with generated notes, with a dry-run mode.v3tag in sync while major version 3 is still supported, and warn in the run when a release no longer applies to it.update-action-tag.ymlso there is a single, supported release process.Why
Today, releasing this repo only supports moving a floating major-version tag to the tip of
main. There is no way to cut a documented, reproducible release, and the floating tag itself is flagged by semgrep'sgithub-actions-mutable-action-tagrule as a supply-chain risk. See DRIVERS-3601.Test plan