Repository navigation
Conversation
The release run tagged a version before anything had built the image on main: the only pre-release gates were compose and shell validation, and the image was built for the first time after semantic-release had published. A build error then left a version tag and GitHub release without an image. The release was also not pinned, so a push landing during the run was tagged without being built or validated by it. * The PR-only image build now runs on every event without pushing (docker-build-validate) and the release job needs it and requires its success - a failed build skips the release and the image push * modules-semantic-release is called with ref: github.sha, so the run releases exactly the commit it validated and built; if main moved on, it releases nothing and the newer run releases both * The image push stays gated on release-created == 'true', so a PR run, a branch dispatch or a run without a release publishes nothing Prepares the workflow for being dispatched by the Dependabot auto-merge after a merge (workflow_dispatch already existed, no required inputs).
The auto-merge merges with the GITHUB_TOKEN, and a push made with it starts no workflow, so a merged Dependabot update was never released until the next human push. * release-workflow set to docker-release.yml: after a merge - and only then - the module dispatches it on main, waits for the run and fails the job if the release does not succeed * actions: write granted for the dispatch and reading the run; checks and statuses read added as documented by the module, so CI results stay readable should the repository ever become private * required-workflows and the unfiltered pull_request trigger unchanged
The commit prefix of a merged Dependabot update decides whether semantic-release cuts a release and the image is rebuilt. * docker: dropped include: "scope" - with a prefix that already has a scope Dependabot appends "(deps)" and produces the malformed "fix(docker)(deps): ..." subject * pip (/src): added an entry so security updates of the packages installed into the image use fix(deps) instead of the detected chore(deps), which released nothing (see the flask update in #1). Version updates stay off (open-pull-requests-limit: 0) as before; security updates are not subject to the limit * github-actions keeps chore(ci); labels and schedules unchanged
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Dependabot auto-merge merges with the
GITHUB_TOKEN, which starts nopushworkflow - a merged update was never released until the next human push.docker-maintenance-dependabot.ymlcan now dispatch the release itself (release-workflow, automation-templates #132). This PR wires that up and makes the release workflow safe to be dispatched: no broken images, no broken releases.Changes
ci(release)-.github/workflows/docker-release.ymldocker-build-validate, formerly the PR-onlydocker-build-pr). The release jobneeds:it plus both validations and requires their success - a failed build skips the release and the image push. Before, the first image build onmainhappened only after semantic-release had already tagged.modules-semantic-release.ymlis called withref: ${{ github.sha }}: the run releases exactly the commit it validated and built.docker-build-release) stays gated onrelease-created == 'true'.workflow_dispatch(no required inputs) already existed; the release job already ran on it; noconcurrency:; registry secrets are org Actions secrets.ci(dependabot)-.github/workflows/docker-maintenance.ymlrelease-workflow: .github/workflows/docker-release.ymlactions: write(dispatch, read the run), pluschecks: read/statuses: readas documented by the module.required-workflowsand the unfiltered trigger unchanged.ci(dependabot)-.github/dependabot.ymlinclude: "scope"- withprefix: "fix(docker)"it yieldsfix(docker)(deps): ..../src: new entry so Dependabot security updates usefix(deps)(they arrived aschore(deps)and released nothing, see chore(deps): bump flask from 3.1.2 to 3.1.3 in /src #1). Version updates stay off (open-pull-requests-limit: 0); raise it to also get weekly pip version PRs.chore(ci).Proof
docker-release.ymlon this branch: validation + image build ran and passed, semantic-release ran and released nothing (it only releases frommain), the image push job was skipped. Run link in the comments below.