fix(release): call the dev version bump instead of listening for an event that never fires

[lidge-jun]

Summary

.github/workflows/dev-version-bump.yml has never run. Not once since it landed in #3013 — gh api .../workflows/346296606/runs returns total_count: 0, across v2.37.0, v2.38.0 and v2.39.0. Every one of those bumps was still opened by hand (#3045, #3076, #3127), which is exactly the chore the workflow was written to end.

The workflow was not broken. The event never existed.

Why the event never arrives

release.yml creates the GitHub release with GH_TOKEN: ${{ github.token }} (release.yml:350), and GitHub does not start new workflow runs from events raised by the default GITHUB_TOKEN. So a release: published listener can never observe a release this repository publishes itself — on any branch. The old header blamed the default-branch resolution trap, which is real but was not what stopped it: moving the file to main (which #3013 did) armed nothing.

The tag push does not rescue it either. release.yml pushes refs/tags/vX.Y.Z with the same token, and no workflow run exists for those tag pushes.

The fix

release.yml calls the bump workflow after a successful publish, so the run is a child of the release run rather than a reaction to an undelivered event:

bump-dev-version:
  needs: publish
  if: ${{ inputs.dry-run != true }}
  uses: ./.github/workflows/dev-version-bump.yml
  with:
    released-version: v${{ inputs.version }}

dev-version-bump.yml becomes on: workflow_call with a released-version input, replacing the two github.event.release.tag_name reads.

No new credential. No PAT, no app token, no contents: write added to the release job. The called workflow keeps its own contents: write / pull-requests: write scoped to its own job, and ruleset Protect dev still means a human merges the resulting PR. This changes how the job starts, nothing about what it may do.

Failure and dry-run behavior. needs: publish already skips the job unless the publish succeeded; the explicit condition only adds the dry-run case. A failed publish or a failed release creation opens nothing.

Both channels call it, and that is safe. bump-dev-version.ts compares against what dev already carries, verified against the current tree:

preview publish while dev=2.40.0 -> {"changed":false,"reason":"dev already carries 2.40.0, which is ahead of the published 2.40.0-preview.20260910"}
stable  publish while dev=2.40.0 -> {"changed":true,"version":"2.41.0"}

Every later step is gated on changed, so the preview call is a no-op in the usual train and the stable call opens the one PR. A preview publishing while dev is genuinely behind still bumps it.

One non-obvious detail

bump-dev-version is declared first in release.yml, ahead of the jobs it depends on. tests/ci-workflows.test.ts:735 splits the workflow on - name: and reads each run: block to the start of the next one, checking that dispatch inputs never interpolate into shell source. A job declared after the last step lands inside that window and reads as shell — the test failed on the first two placements I tried, correctly. Job order in YAML carries no execution meaning (needs does), so declaring it before its own dependency costs nothing and keeps the injection check honest rather than weakening it.

Verification

$ bun test tests/ci-workflows.test.ts tests/cleanup-orphaned-workflows.test.ts \
           tests/release-version-line.test.ts tests/bump-dev-version.test.ts
 155 pass
 0 fail

Both workflows re-parse as valid YAML with the expected job graph, and no github.event.release reference remains in the bump workflow.

What this cannot verify here

A workflow_call body resolves from the caller's ref, and release.yml only runs on main or preview. So this takes effect after an ordinary dev → main promotion carries it there — the next release is the first real exercise. That is the same activation delay #3013 had, now for a different reason, and it is stated here rather than discovered later.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Chores
  • Improved the release process to automatically update the development version after a successful production release.
  • Prevented development-version updates during dry-run releases.
  • Improved compatibility between release workflows and self-published releases.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T03:31:37.631220Z	55ce2c1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 8a8c51bb-97a4-47f2-b7ad-e0fedec5f0e5

📥 Commits

Reviewing files that changed from the base of the PR and between 33d32b6 and 55ce2c1.

📒 Files selected for processing (2)

• .github/workflows/dev-version-bump.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Changes

The release workflow now directly invokes the development version bump workflow after a successful non-dry-run publish. The reusable workflow accepts the released version as an input and uses it in its version calculation and pull-request steps.

Development version bump flow

Layer / File(s)	Summary
Reusable workflow input propagation .github/workflows/dev-version-bump.yml	Lines 17–45 replace the release: published trigger with a required workflow_call input. Lines 89 and 108 use inputs.released-version for RELEASED_VERSION.
Release workflow integration .github/workflows/release.yml	Lines 39–73 add a bump-dev-version job. The job waits for publish, skips dry runs, and passes v${{ inputs.version }} to the reusable workflow.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant DevVersionBumpWorkflow
  participant VersionDecidingStep
  participant PullRequestOpeningStep
  ReleaseWorkflow->>DevVersionBumpWorkflow: Pass released-version
  DevVersionBumpWorkflow->>VersionDecidingStep: Set RELEASED_VERSION
  DevVersionBumpWorkflow->>PullRequestOpeningStep: Set RELEASED_VERSION

Loading

Suggested reviewers: ingwannu, wibias

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dev-version-bump-never-fires

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55ce2c115e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Grant the reusable call its required write scopes

On every successful non-dry-run release, this call inherits the workflow-level permissions: {}, while GitHub only permits a called reusable workflow to maintain or reduce the caller's token permissions. The called job therefore cannot elevate itself to contents: write or pull-requests: write, so the push or PR creation will be rejected and the intended version-bump PR will not open. Grant those two scopes on this calling job; they will remain isolated from publish.

AGENTS.md reference: .github/AGENTS.md:L16-L16

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Trigger checks for the bot-created pull request

After the caller's permissions are fixed, every bump that changes dev still pushes the branch and creates its PR with the default github.token. GitHub suppresses workflow runs for events generated by that token—the same behavior motivating this change—so neither the branch push nor PR creation starts ci.yml or enforce-pr-target.yml; the automated PR will consequently lack its required checks until a human retriggers an event. Create it with an approved non-default credential or explicitly arrange a non-suppressed trigger for the required PR workflows.

AGENTS.md reference: .github/AGENTS.md:L16-L18

Useful? React with 👍 / 👎.