chore(release): adopt shared forensic release pipeline - #1514
Merged
Conversation
Replace the manual-dispatch semantic-release flow with three thin caller stubs consuming the shared forensic PR-to-release pipeline in chhoumann/obsidian-plugin-workflows, pinned at @v2. - release-prepare.yml / release-trigger.yml / release.yml: caller stubs (trigger + uses:), all logic in the shared reusables. - Remove the semantic-release config block, the semantic-release devDeps (@semantic-release/exec, @semantic-release/git, semantic-release), the now-dead @semantic-release/github>undici override, and version-bump.mjs. - Keep buildGitInfo.mjs (build tooling for esbuild dev defines). - Delete tests/release-workflow-hardening.test.ts: it pinned the inline hardening of the old release.yml, which the thin stub removes; those guarantees now live in the shared reusables. The App bot (quickadd-release-bot) now authors the release commit + PR in prepare instead of pushing semantic-release output. Attestation, the App identity, and opt-in Slack/Discord notify are preserved; the per-release PR-comment step is dropped.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe release process now uses separate preparation and validation workflows plus a reusable release execution workflow. The previous inline release implementation, semantic-release dependencies, version helper, and related guidance were removed or updated. ChangesRelease pipeline migration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI
participant Prepare
participant Validate
participant Release
participant ReusableWorkflow
CI->>Prepare: successful CI completion
Prepare->>ReusableWorkflow: prepare release
Validate->>ReusableWorkflow: validate merged release PR
Validate->>Release: trigger release workflow
Release->>ReusableWorkflow: execute release with metadata and checks
Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying quickadd with
|
| Latest commit: |
4285526
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://44ad1e8a.quickadd.pages.dev |
| Branch Preview URL: | https://chore-shared-release-pipelin.quickadd.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 32: The repository guidance references the shared release pipeline, but
the comment in the PR-title workflow still uses stale semantic-release
terminology. Update the relevant comment in the workflow so it consistently
describes releases as being determined by the shared pipeline, or remove the
outdated comment entirely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a9ee3b5f-de70-48f2-8e86-93f59631ab96
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (7)
.github/workflows/release-prepare.yml.github/workflows/release-trigger.yml.github/workflows/release.ymlAGENTS.mdpackage.jsontests/release-workflow-hardening.test.tsversion-bump.mjs
💤 Files with no reviewable changes (3)
- version-bump.mjs
- tests/release-workflow-hardening.test.ts
- package.json
The shared release pipeline's standing PRs are titled 'release(version): Release <x.y.z>'; without this the pr-title check red-flags every release PR (same fix as MetaEdit 6cc0763).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Migrates QuickAdd onto the shared forensic release pipeline in
chhoumann/obsidian-plugin-workflows(pinned
@v2,workflows-ref: v2). QuickAdd's old release path was amanually dispatched
semantic-releaserun; this replaces it with thestanding-PR model every plugin now shares: after green CI on
master, theper-repo App bot opens/refreshes one release PR, and merging that PR is the
sole release act. A fix now lands once in the shared repo and every plugin
picks it up by bumping a pin.
The old
release.yml(9 KB of inline logic), thesemantic-releaseconfig +dev deps, and
version-bump.mjsare replaced by three thin caller stubs(trigger +
uses:); all logic lives in the shared reusables.Line delta
+162 / -2620across 8 files. The bulk ispnpm-lock.yaml(-2317, pruning thesemantic-releasedependency tree) and the oldrelease.ymlinternals (-223).Three stubs total ~130 lines. 277 packages removed from the lockfile.
Parity audit vs the old flow
Every guarantee in the old
release.ymlwas mapped to its new home in theshared reusables.
Preserved:
release.yml)@v2)main.js/manifest.json/styles.cssrelease.ymlattest job (attest-build-provenance), plus post-publishgh attestation verify+ per-asset re-hash (stronger than before)quickadd-release-bot)release-prepare.ymlmints the App token and authors the commit + PR as the botpersist-credentials: falsewhile install/build/test runspnpm build,pnpm test)release.ymlbuild job:build-command(pnpm run build) +verify-commands(lint,check,test)release.ymlnotify job, wired viaslack-webhook/discord-webhooksecretsconcurrencyon each stub + reusableGained (new forensic guarantees the old flow lacked): standing-PR
provenance checks, exact version-file-diff validation, commit-message/parent and
squash-tree binding, prior-tag ancestry + history-unchanged checks, a durable
release-run/<version>recovery branch, and no direct pushes tomaster(releases go through a reviewable PR).
Deviations (intended, flagged - not silently dropped)
Release model: manual dispatch -> PR merge. The old flow was triggered by
hand (
workflow_dispatchrunningsemantic-release, which pushed theversion commit + tag and created the release in one shot). The new flow is
PR-to-release: the bot opens a standing version-bump PR and merging it is the
release. No manual dispatch on the happy path (a
workflow_dispatchescapehatch remains for dry-run/recovery).
App-bot role changes. The App (
quickadd-release-bot) previously onlypushed semantic-release's output; commits were authored by
semantic-release-bot. It now authors the release commit + PR in prepare,so forensic author checks bind to the App identity. This is why it needs a
new permission (below).
Per-release PR-comment DROPPED. The old flow ran
find-pr+ agithub-scriptstep to post aRelease has been published: vXcomment on thetriggering PR. The shared pipeline has no equivalent, so this feature is gone.
Flagging explicitly; if wanted, it would need to be added to the shared repo,
not here (the stubs carry no logic).
app-idis a repository VARIABLE, not a secret. The reusablerelease-prepare.ymltakesapp-idas awith:input, and GitHub does notallow the
secretscontext in a reusable-workflowwith:block. QuickAddcurrently stores
RELEASE_APP_IDas a secret; a repo variableRELEASE_APP_IDmust be created (see REQUIRED BEFORE MERGE).RELEASE_APP_PRIVATE_KEYstays a secret and carries over unchanged.
Test-file note
tests/release-workflow-hardening.test.tswas deleted. It textuallyasserted the inline hardening of the old
release.yml(App-token leastprivilege,
persist-credentials: false). That inline workflow is exactly whatthe thin stub removes, so the test's subject no longer exists here; the
hardening is now covered by the shared repo's reusables and their tests.
Dry-run plan evidence
Ran the shared repo's
release-plan.mjsagainst this repo's real git history(
node release-plan.mjs --cwd <quickadd> --package-manager pnpm).Current
masterHEAD (405183c) - the post-2.19.0chore(e2e)commits plana patch bump:
{"baseSha":"405183c...","previousVersion":"2.19.0","nextVersion":"2.19.1","releaseType":"patch","release":true,"schemaVersion":1}Historical base
22e439d(the commit 2.19.0 released from) - reproduces thereal 2.19.0 release exactly:
{"baseSha":"22e439d...","previousVersion":"2.18.1","nextVersion":"2.19.0","releaseType":"minor","release":true, "notes":"# 2.19.0 ... ### Features\n* **ai:** provider-scoped model identity (#1499) ...\n* **settings:** craft pass on the choices list (#1500) ..."}Precondition check (planner baseline)
Aligned -
package.json2.19.0== latest tag2.19.0== latest publishedGitHub release
2.19.0. No action needed.Gates (all green locally)
pnpm run test: 3825 passed / 37 skipped (340 files).pnpm run build-with-lint: green (tsc+ eslint + esbuild; producesmain.js+styles.css).actionlintclean.REQUIRED BEFORE MERGE
The pipeline fails closed without these. CI (Test, Build + Lint, CodeQL,
etc.) is unaffected meanwhile; only releases are blocked until done.
quickadd-release-bot. Verified via the API: the botuser
quickadd-release-bot[bot](id293432345) exists, and the App holdsalwaysbypass on themasterruleset (Integration id4046320, likely theApp id). No action beyond confirming.
Pull requests: Read and writeto the App. It authors PRs now; todayit likely only has
Contents: write(for the old push). Without this, preparecannot open the release PR.
RELEASE_APP_ID(Settings -> Secrets andvariables -> Actions -> Variables) with the App's numeric id. It currently
exists only as a secret, which cannot be passed to the reusable's
app-idwith:input. The App id is likely4046320(the master-ruleset Integrationbypass actor) - confirm from the App settings.
RELEASE_APP_PRIVATE_KEY(secret) is unchanged.
Branch-protection bypass is already satisfied (the App is an
alwaysbypassactor on
master). After the three items above, smoke-test via Actions ->Prepare release -> Run workflow with the
# dry-run: trueline uncommented,before the first real release.
Do not auto-merge
Christian merges this himself after provisioning the App variable + permission.
Summary by CodeRabbit
release.semantic-releasedevelopment dependencies/overrides.