DRIVERS-3601 Add a unified release workflow with semver tagging and GitHub Releases - #115
DRIVERS-3601 Add a unified release workflow with semver tagging and GitHub Releases#115blink1073 wants to merge 16 commits into
Conversation
- Replace delete-then-recreate v3 tag handling with force-tag + force-push to avoid a window where the remote v3 tag is deleted but recreation can fail (local v3 already exists due to fetch-depth: 0), which would leave v3 consumers broken. - Capture next-version.sh stderr separately and surface it in the job summary so the bootstrap-mode notice (major bump silently ignored when no vX.Y.Z tags exist yet) is visible to the operator.
|
Semgrep found 3 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. 🛟 Help? Slack #semgrep-help or go/semgrep-help. Resolution Options:
|
There was a problem hiding this comment.
Pull request overview
Adds a unified, dispatchable release workflow that computes the next semver version, optionally bumps the major-version file, creates signed tags, and publishes a GitHub Release—replacing the older floating-tag-only workflow and documenting the v3→v4 floating-tag change for consumers.
Changes:
- Introduces
.github/workflows/release.ymlto drive semver tagging + GitHub Releases with adry_runmode and optional floatingv3tag update. - Retires
.github/workflows/update-action-tag.ymlin favor of a single release entrypoint. - Adds bash scripts + CI tests to compute the next version and bump the major-version file; updates docs to reflect the new process and tagging policy.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents floating major tag policy through v3 and immutable semver tags starting v4. |
| CONTRIBUTING.md | Updates contributor release instructions to use the new Release workflow. |
| .github/workflows/update-action-tag.yml | Removes the legacy floating-tag update workflow. |
| .github/workflows/release.yml | Adds the unified release workflow: version calculation, optional major bump, signed tags, and GitHub Release creation. |
| .github/workflows/ci.yml | Adds CI job to run tests for the new release scripts. |
| .github/scripts/next-version.sh | Implements next semver computation based on existing tags (with bootstrap from floating major tag). |
| .github/scripts/next-version.test.sh | Adds tests for next-version logic (bootstrap, patch/minor/major, sorting, invalid input). |
| .github/scripts/bump-major-version.sh | Writes the major component of a semver version into version.txt (or provided file). |
| .github/scripts/bump-major-version.test.sh | Adds tests for bump-major-version behavior and error handling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Warn about floating tag retirement | ||
| if: env.IS_V3 != 'true' | ||
| shell: bash | ||
| run: | | ||
| MESSAGE="Release v${NEXT_VERSION} does not use floating tags. Remove the floating-tag-update steps (Create/Push v3 tag, and this warning) from .github/workflows/release.yml." | ||
| echo "::warning::$MESSAGE" | ||
| echo "$MESSAGE" >> "$GITHUB_STEP_SUMMARY" |
There was a problem hiding this comment.
This message may only be read by the person who creates the release. That doesn't seem very useful to me.
There was a problem hiding this comment.
Right, it is mean a a signal for the releaser to remove the floating tag handling in the code.
Co-authored-by: Jérôme Tamarelle <jerome.tamarelle@mongodb.com>
Summary
release.ymlworkflow that bumps the version (patch, minor, or major), creates a signed release tag, and publishes a GitHub Release with generated notes.v3tag in sync while major version 3 is supported, then warn once a release no longer needs it.update-action-tag.yml, leaving one supported release process.Why
Releasing this repo today only moves a floating major-version tag to the tip of
main, so there's no documented, reproducible release. Semgrep'sgithub-actions-mutable-action-tagrule flags that floating tag as a supply-chain risk. See DRIVERS-3601.Test plan