ci: add release workflow and script - #248
Merged
Merged
Conversation
Automate release PR creation via GitHub Actions workflow_dispatch. Script handles version bump, AI changelog (GitHub Models / gpt-4o-mini), and CHANGELOG.md update. Works locally and in CI (--prepare mode). Existing tag-push release.yml untouched.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughRelease automation now resolves stable and prerelease versions, generates changelogs, updates release files, supports local or CI preparation, creates release pull requests through GitHub Actions, validates merged release PRs before tagging, and adds automated script coverage and documentation. ChangesRelease automation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant GitHubActions
participant release.sh
participant GitHubAPI
Maintainer->>GitHubActions: dispatch release workflow
GitHubActions->>release.sh: prepare version and changelog
release.sh-->>GitHubActions: return release metadata and updated files
GitHubActions->>GitHubAPI: create verified commit and release branch
GitHubAPI-->>GitHubActions: create or update pull request
sequenceDiagram
participant GitHub
participant TagReleaseWorkflow
participant Git
GitHub->>TagReleaseWorkflow: notify merged release pull request
TagReleaseWorkflow->>TagReleaseWorkflow: validate repository, branch, and version
TagReleaseWorkflow->>Git: create or verify annotated tag
Git-->>TagReleaseWorkflow: push tag to origin
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Adds --rc flag to release.sh and prerelease boolean input to the workflow. When set, appends -rc.1 (or increments if already RC).
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/create-release-pr.yml:
- Around line 36-40: Update the Checkout step using actions/checkout@v4 to
disable credential persistence by setting persist-credentials to false, while
preserving the existing fetch-depth and ref configuration.
- Around line 78-128: Update the release commit flow around getCommit and
createCommit to resolve refs/heads/main explicitly and use that main commit SHA
instead of context.sha. Ensure both the base tree lookup and the new commit’s
parents reference the resolved main branch commit, preserving the existing blob
and tree creation.
In `@scripts/release.sh`:
- Around line 228-264: Update both release PR body templates in the PREPARE CI
mode and local mode paths to wrap CHANGELOG_SECTION in the required markdown
fenced block, including the opening ```markdown and closing ``` markers. Keep
the checklist outside the fence, and extract or reuse a shared template/helper
if appropriate so both generated BODY_FILE contents remain consistent.
- Around line 266-305: Make the local-mode release flow idempotent like the CI
path: reuse or reset the existing local $BRANCH instead of unconditionally
running checkout -b, and push updates with a safe force strategy when the remote
branch already exists or diverges. Before gh pr create, look up an existing open
PR for $BRANCH and update it when found; create a new PR only when none exists.
- Around line 70-81: Update bump_version so the patch case detects a pre-release
suffix in the current version and returns the same major.minor.patch version
without the suffix, promoting it to stable; only increment patch for
already-stable versions. Preserve the existing major and minor behavior and
invalid bump-kind handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 21f2da29-04c5-4c87-9d1d-95469c7684d5
📒 Files selected for processing (3)
.agents/skills/release/SKILL.md.github/workflows/create-release-pr.ymlscripts/release.sh
When --rc is set and input version matches current base: - If current is already RC (e.g. 1.3.1-rc.1) → increment to rc.2 - If current is stable (e.g. 1.3.1) → error: already released Also fix grep -oP (GNU-only) to sed for macOS compatibility.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/release.sh`:
- Around line 99-124: Update the RC handling logic in the release script to
reject any TARGET_VERSION whose base version already has a
refs/tags/v<base-version> tag, not only when it matches the current stable
version. Perform this tag-existence check before incrementing or appending an RC
suffix, while preserving the existing behavior for untagged versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 38463142-ebfb-46ac-950b-c10f09f66b8f
📒 Files selected for processing (2)
.github/workflows/create-release-pr.ymlscripts/release.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/create-release-pr.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 108: Update the automated release flow around scripts/release.sh so its
generated changelog uses the fenced markdown release-notes contract expected by
the extractor in .github/workflows/release.yml. Ensure the AI-generated
changelog is enclosed in the required markdown fence and remains available as
the GitHub Release notes, or update both producer and extractor consistently
while preserving the documented contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
- Add persist-credentials: false to checkout (security) - Resolve refs/heads/main explicitly in github-script (data integrity) - --bump patch now promotes RC to stable instead of skipping - Wrap changelog in markdown fence for release.yml compatibility - Make local-mode idempotent (-B, force-with-lease, update existing PR) - Reject RC for already-tagged stable versions - Update PR checklist to reflect auto-tagging
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/create-release-pr.yml (1)
139-146: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftUse a signed commit here
createCommitis called without asignature, so this produces an unsigned commit. If this step must produce a signed commit, pass a valid signature or switch to a signedgit commitflow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/create-release-pr.yml around lines 139 - 146, Update the createCommit call in the release workflow to produce a signed commit by supplying a valid signature, or replace this API-based creation with a signed git commit flow. Preserve the existing owner, repository, message, tree, and parent values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-release.yml:
- Around line 36-39: Update the “Create and push tag” workflow step to handle an
existing tag idempotently: fetch the tag, verify it resolves to the intended
commit, and exit successfully only when it matches; otherwise fail, while
preserving tag creation and push for missing tags.
- Around line 14-31: The release workflow’s version extraction and tagging must
not trust interpolated PR-title data or arbitrary merged branches. Update the
version step to receive the PR title through an environment variable, then
validate the extracted version and require the merged PR’s head repository to
match the base repository and its head ref to equal release/$VERSION before
creating the tag.
---
Outside diff comments:
In @.github/workflows/create-release-pr.yml:
- Around line 139-146: Update the createCommit call in the release workflow to
produce a signed commit by supplying a valid signature, or replace this
API-based creation with a signed git commit flow. Preserve the existing owner,
repository, message, tree, and parent values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0236b998-83a2-4fd2-a498-bf895ec96f93
📒 Files selected for processing (4)
.github/workflows/create-release-pr.yml.github/workflows/tag-release.ymlAGENTS.mdscripts/release.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- AGENTS.md
- scripts/release.sh
- tag-release: idempotent tag creation (skip if same commit, fail if different) - tag-release: validate trust boundaries (same repo, release/* branch) - tag-release: receive PR title via env var, not direct interpolation - create-release-pr: document API commit security model
psjostrom
force-pushed
the
ci/release-workflow
branch
from
July 25, 2026 10:19
8f08d43 to
152a3af
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-release.yml:
- Around line 70-81: Update the existing-tag lookup in the tag verification
block to request and parse the peeled commit SHA for annotated tags, rather than
comparing the tag-object and peeled output together. Ensure EXISTING_SHA
contains a single commit SHA matching COMMIT_SHA while preserving the existing
skip and mismatch handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1ce8e0bd-0b88-44c5-9444-37c3e3ba0b28
📒 Files selected for processing (2)
.github/workflows/create-release-pr.yml.github/workflows/tag-release.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/create-release-pr.yml
psjostrom
force-pushed
the
ci/release-workflow
branch
from
July 25, 2026 10:52
0672992 to
f043e73
Compare
- Remove v prefix from branch name and commit/PR titles in SKILL.md and AGENTS.md manual fallback (release/vX.Y.Z → release/X.Y.Z) - Add scripts/test-release.sh (11 tests for version bumping, RC logic) - Add docs/internal/release-automation.md (pipeline docs, trust boundaries, failure modes)
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/tag-release.yml (1)
62-63: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin
actions/checkoutto a full commit SHA.
@v4is mutable; a retagged or compromised action would execute with this job’s write token. Pin a verified SHA and update it through dependency automation. GitHub identifies full SHAs as the immutable option for Actions dependencies. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tag-release.yml around lines 62 - 63, Update the Checkout step’s actions/checkout reference from the mutable `@v4` tag to a verified full commit SHA, preserving the existing major-version behavior, and configure it for dependency automation updates.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/internal/release-automation.md`:
- Line 49: Update the workflow DAG fenced code block in the release automation
documentation to specify the text language, changing the opening fence to use
text while preserving the diagram contents.
In `@scripts/test-release.sh`:
- Around line 229-230: Update the assertion after the release preparation
command to read and validate the generated CHANGELOG.md content rather than the
generic command output. Assert a known commit subject expected in the written
changelog, while preserving the existing version preparation flow and assertion
context.
- Around line 212-213: Update the “both flags” case in the release test to
invoke the copied release script that exists in the temporary repository, using
the same script path established by the surrounding test setup. Keep the
conflicting --version and --bump arguments and assert the command exits nonzero
so their validation is actually exercised.
---
Nitpick comments:
In @.github/workflows/tag-release.yml:
- Around line 62-63: Update the Checkout step’s actions/checkout reference from
the mutable `@v4` tag to a verified full commit SHA, preserving the existing
major-version behavior, and configure it for dependency automation updates.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4a1b52bc-f8db-494e-b9cd-c4bf7bb7ff30
📒 Files selected for processing (6)
.agents/skills/release/SKILL.md.github/workflows/create-release-pr.yml.github/workflows/tag-release.ymlAGENTS.mddocs/internal/release-automation.mdscripts/test-release.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/create-release-pr.yml
- .agents/skills/release/SKILL.md
This was referenced Jul 25, 2026
2 tasks
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Testing
scripts/release.sh --bump patch --prepare(dry run)Summary by CodeRabbit
versionNameand changelog.