Fix releases on protected branches - #31
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the shared reusable release workflow to work correctly with protected branches by preparing release changes via a PR and only tagging/publishing after that PR has merged, preventing tags from pointing at unmerged commits.
Changes:
- Adds
pull-requests: writepermission and arelease_commit_existsoutput to distinguish “prepare PR” runs from “finalize publish” runs. - Detects a merged release-preparation commit and skips generating a second bump/changelog when finalizing.
- Opens a release-preparation PR (attempting auto-merge) and gates tag/release/publish jobs to only run on the post-merge workflow run.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+631
to
+642
| - name: Open and auto-merge release-preparation PR | ||
| if: inputs.dry_run != true && needs.prepare.outputs.release_commit_exists != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| VERSION="${{ needs.prepare.outputs.new_version }}" | ||
| BRANCH="release/v${VERSION}" | ||
| BASE="${{ github.ref_name }}" | ||
|
|
||
| git switch -c "$BRANCH" | ||
| git push --force-with-lease origin "HEAD:$BRANCH" | ||
|
|
Comment on lines
+643
to
+644
| PR_URL=$(gh pr list --repo "${{ github.repository }}" --head "$BRANCH" --base "$BASE" --state open --json url --jq '.[0].url') | ||
| if [ -z "$PR_URL" ]; then |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The shared release workflow now prepares version and changelog changes on a release PR, enables auto-merge, and only tags or publishes after that PR has merged to the protected branch.
Why
The prior workflow attempted a direct push to protected main. GitHub rejected the commit after accepting the tag, leaving an unreconciled tag and no published artifacts.
Impact
Release tags now point only to merged protected-branch commits. Required checks and approvals remain enforced; if auto-merge is unavailable, the release PR remains ready for a maintainer instead of bypassing protection.
Validation