Skip to content

fix: make release workflow compatible with branch protection#1260

Merged
Mossaka merged 1 commit intomainfrom
fix/release-workflow-branch-protection
Mar 12, 2026
Merged

fix: make release workflow compatible with branch protection#1260
Mossaka merged 1 commit intomainfrom
fix/release-workflow-branch-protection

Conversation

@Mossaka
Copy link
Collaborator

@Mossaka Mossaka commented Mar 12, 2026

Summary

  • The release workflow has been failing since branch protection rules were added to main
  • Root cause: git push origin HEAD --tags (later changed to git push origin "v$VERSION") fails because branch protection blocks direct pushes, but package.json on main becomes stale without the version bump commit
  • The first failed run (Mar 12) pushed tag v0.23.2 but the step failed; subsequent retries fail with "tag already exists"

Fix

  1. Derive version from git tags instead of package.json — git tags are authoritative, package.json on main may be stale since we can't push version-bump commits
  2. Only push the tag — the tagged commit has the correct package.json, downstream jobs checkout by tag ref
  3. Idempotent retry support — if a tag already exists from a previous partial run, reuse it instead of failing

Test plan

  • After merge, clean up orphaned v0.23.2 tag: git push origin :refs/tags/v0.23.2
  • Trigger release workflow with minor bump
  • Verify the workflow completes successfully
  • Verify release artifacts and Docker images are published

🤖 Generated with Claude Code

The release workflow failed because branch protection rules block direct
pushes to main. This fix:

1. Derives version from git tags instead of package.json (which may be
   stale since we can't push version-bump commits to main)
2. Only pushes the tag, not the commit to main
3. Handles idempotent retries when a tag already exists from a previous
   partial run

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 12, 2026 17:32
@github-actions
Copy link
Contributor

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 82.56% 82.70% 📈 +0.14%
Statements 82.57% 82.70% 📈 +0.13%
Functions 83.01% 83.01% ➡️ +0.00%
Branches 75.12% 75.20% 📈 +0.08%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/docker-manager.ts 84.1% → 84.6% (+0.54%) 83.4% → 83.9% (+0.52%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the release GitHub Actions workflow to work with protected branches by treating git tags as the source of truth for versioning, pushing only the release tag (not a version-bump commit to the protected branch), and allowing retries when a tag already exists.

Changes:

  • Derive the “current” version from existing git tags instead of package.json.
  • Create a local version-bump commit, tag it, and push only the tag (so branch protection doesn’t block the release).
  • Add idempotent behavior to reuse an existing release tag on retry.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

# Derive current version from git tags (authoritative source),
# not package.json which may be stale on main since we can't
# push version-bump commits to protected branches.
LATEST_TAG=$(git tag --sort=-version:refname | grep '^v[0-9]' | head -n1 || echo "v0.0.0")
Copy link

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LATEST_TAG is derived from all repository tags. Since this workflow explicitly allows running on maintenance branches (v*.x), this can pick a newer tag from another release line (e.g., main), causing the maintenance branch release to bump from the wrong base version. Consider restricting the tag selection to tags reachable from the current HEAD (e.g., only tags merged into this branch) and/or filtering to the branch’s version series.

Suggested change
LATEST_TAG=$(git tag --sort=-version:refname | grep '^v[0-9]' | head -n1 || echo "v0.0.0")
BRANCH_REF="${GITHUB_REF#refs/heads/}"
if [[ "$BRANCH_REF" == "main" ]]; then
TAG_PATTERN='^v[0-9]'
elif [[ "$BRANCH_REF" =~ ^v([0-9]+)\.x$ ]]; then
SERIES="${BASH_REMATCH[1]}"
TAG_PATTERN="^v${SERIES}\."
else
echo "::error::Unsupported release branch: $BRANCH_REF"
exit 1
fi
# Only consider tags reachable from the current HEAD and matching the branch's version series
LATEST_TAG=$(git tag --merged HEAD --sort=-version:refname | grep -E "$TAG_PATTERN" | head -n1 || echo "v0.0.0")

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Contributor

Smoke Test Results ✅ PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #1260

@github-actions
Copy link
Contributor

Smoke Test Results

GitHub MCP: #1258 fix: push only tag in release workflow | #1249 feat(proxy): add --openai-api-target and --anthropic-api-target flags
Playwright: github.com title contains "GitHub"
File Write: /tmp/gh-aw/agent/smoke-test-claude-23015283051.txt created
Bash Verify: File contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1260

@github-actions
Copy link
Contributor

fix: push only tag in release workflow to avoid branch protection violation | feat(proxy): add --openai-api-target and --anthropic-api-target flags
Review last 2 merged PRs: ✅
safeinputs-gh PR list: ✅
Playwright title check: ✅
Web search (Tavily): ❌
File write: ✅
Bash cat: ✅
Discussion comment: ✅
Build: ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1260

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants