Skip to content

ci: make release workflows respect branch protection (dispatch opens PR) #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jung-thomas merged 1 commit into from
Jul 13, 2026
Merged

ci: make release workflows respect branch protection (dispatch opens PR) #165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 59 additions & 24 deletions .github/workflows/release-agent-instructions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ on:
push:
tags:
- 'agent-v*'
branches:
- main
workflow_dispatch:
inputs:
version:
Expand All @@ -13,6 +15,7 @@ on:

permissions:
contents: write
pull-requests: write

concurrency:
group: release-agent-instructions
Expand All @@ -21,6 +24,9 @@ concurrency:
jobs:
test:
name: Test Suite
# Release paths only: an agent-v* tag push or a manual dispatch.
# A plain push to main (merged release PR) is handled by auto-tag.
if: startsWith(github.ref, 'refs/tags/agent-v') || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
Expand All @@ -42,13 +48,10 @@ jobs:
run: npm run test:ci

prepare:
name: Prepare Release
name: Prepare Release PR
needs: test
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
outputs:
version: ${{ steps.calc.outputs.version }}
tag: ${{ steps.calc.outputs.tag }}
steps:
- name: Checkout code
uses: actions/checkout@v4
Expand Down Expand Up @@ -82,22 +85,62 @@ jobs:
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

- name: Commit version bump
- name: Create release branch, commit, and open PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
VERSION="${{ steps.calc.outputs.version }}"
BRANCH="release/agent-v${VERSION}"
git add agent-instructions/package.json
git diff --cached --quiet && echo "No changes to commit" && exit 0
git commit -m "chore: release agent-instructions v${{ steps.calc.outputs.version }} [skip ci]"
if git diff --cached --quiet; then
echo "::error::No version bump changes to commit (version may already be $VERSION)"
exit 1
fi
git checkout -b "$BRANCH"
git commit -m "chore: release agent-instructions v${VERSION}"
git push origin "$BRANCH"
gh pr create \
--base main \
--head "$BRANCH" \
--title "chore: release agent-instructions v${VERSION}" \
--body "Automated release version bump for **agent-instructions v${VERSION}**, opened by the Release workflow (workflow_dispatch).

Merging this PR pushes to \`main\`, which triggers the \`auto-tag\` job to create tag \`agent-v${VERSION}\`, which runs the tag-triggered publish path (npm + GitHub release, gated by the \`npm-publish\` environment approval).

Review the version bump, then merge to release."

auto-tag:
name: Auto-tag merged release
# When a release PR is merged (push to main), tag the new agent-instructions
# version. Pushing the tag triggers this workflow via the 'agent-v*' path.
# Idempotent: only tags when the version has no tag yet, so ordinary pushes
# to main (and hana-cli release merges) are a no-op here.
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}

- name: Create and push tag
- name: Tag new version if not already tagged
run: |
git tag -a "agent-v${{ steps.calc.outputs.version }}" -m "Release agent-instructions v${{ steps.calc.outputs.version }}"
git push origin HEAD:${{ github.ref_name }}
git push origin "agent-v${{ steps.calc.outputs.version }}"
VERSION=$(jq -r '.version' agent-instructions/package.json)
if git rev-parse "agent-v${VERSION}" >/dev/null 2>&1; then
echo "Tag agent-v${VERSION} already exists — nothing to release."
exit 0
fi
echo "Tagging new release agent-v${VERSION}"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "agent-v${VERSION}" -m "Release agent-instructions v${VERSION}"
git push origin "agent-v${VERSION}"

resolve-version:
name: Resolve Version from Tag
needs: test
if: github.event_name == 'push'
if: startsWith(github.ref, 'refs/tags/agent-v')
runs-on: ubuntu-latest
outputs:
version: ${{ steps.extract.outputs.version }}
Expand All @@ -113,11 +156,8 @@ jobs:

publish:
name: Publish to npm
needs: [test, prepare, resolve-version]
if: |
always() &&
needs.test.result == 'success' &&
(needs.prepare.result == 'success' || needs.resolve-version.result == 'success')
needs: [test, resolve-version]
if: needs.test.result == 'success' && needs.resolve-version.result == 'success'
runs-on: ubuntu-latest
environment:
name: npm-publish
Expand All @@ -126,13 +166,8 @@ jobs:
- name: Determine version
id: ver
run: |
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
echo "version=${{ needs.prepare.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.prepare.outputs.tag }}" >> $GITHUB_OUTPUT
else
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.resolve-version.outputs.tag }}" >> $GITHUB_OUTPUT
fi
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.resolve-version.outputs.tag }}" >> $GITHUB_OUTPUT

- name: Checkout code at tag
uses: actions/checkout@v4
Expand Down
104 changes: 65 additions & 39 deletions .github/workflows/release-hana-cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ on:
push:
tags:
- 'v*'
branches:
- main
workflow_dispatch:
inputs:
version:
Expand All @@ -15,15 +17,11 @@ on:
required: false
type: string
default: '[]'
publish_mcp_registry:
description: 'Also publish to MCP Registry?'
required: false
type: boolean
default: true

permissions:
contents: write
id-token: write
pull-requests: write

concurrency:
group: release-hana-cli
Expand All @@ -32,6 +30,9 @@ concurrency:
jobs:
test:
name: Test Suite
# Run for the release paths only: a version tag push, or a manual dispatch.
# A plain push to main (e.g. a merged release PR) is handled by auto-tag.
if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
Expand Down Expand Up @@ -60,13 +61,10 @@ jobs:
run: npm run test:ci

prepare:
name: Prepare Release
name: Prepare Release PR
needs: test
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
outputs:
version: ${{ steps.calc.outputs.version }}
tag: ${{ steps.calc.outputs.tag }}
steps:
- name: Checkout code
uses: actions/checkout@v4
Expand Down Expand Up @@ -101,22 +99,65 @@ jobs:
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

- name: Commit version bump and changelog
- name: Create release branch, commit, and open PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
VERSION="${{ steps.calc.outputs.version }}"
BRANCH="release/v${VERSION}"
git add package.json npm-shrinkwrap.json server.json mcp-server/package.json mcp-server/npm-shrinkwrap.json CHANGELOG.json CHANGELOG.md
git diff --cached --quiet && echo "No changes to commit" && exit 0
git commit -m "chore: release v${{ steps.calc.outputs.version }} [skip ci]"
if git diff --cached --quiet; then
echo "::error::No version bump changes to commit (version may already be $VERSION)"
exit 1
fi
git checkout -b "$BRANCH"
git commit -m "chore: release v${VERSION}"
# Push the release branch (allowed — branch protection only blocks main).
git push origin "$BRANCH"
# Open a PR into main. Merging it triggers auto-tag -> publish.
gh pr create \
--base main \
--head "$BRANCH" \
--title "chore: release v${VERSION}" \
--body "Automated release version bump for **v${VERSION}**, opened by the Release workflow (workflow_dispatch).

Merging this PR pushes to \`main\`, which triggers the \`auto-tag\` job to create tag \`v${VERSION}\`, which in turn runs the tag-triggered publish path (npm + GitHub release + MCP registry, gated by the \`npm-publish\` environment approval).

- name: Create and push tag
Review the version bump and changelog, then merge to release."


auto-tag:
name: Auto-tag merged release
# When a release PR is merged (push to main), tag the new version. Pushing
# the tag triggers this same workflow via the 'v*' tag path -> publish.
# Idempotent: only tags when package.json's version has no tag yet, so
# ordinary pushes to main are a no-op.
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}

- name: Tag new version if not already tagged
run: |
git tag -a "v${{ steps.calc.outputs.version }}" -m "Release v${{ steps.calc.outputs.version }}"
git push origin HEAD:${{ github.ref_name }}
git push origin "v${{ steps.calc.outputs.version }}"
VERSION=$(jq -r '.version' package.json)
if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
echo "Tag v${VERSION} already exists — nothing to release."
exit 0
fi
echo "Tagging new release v${VERSION}"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "v${VERSION}" -m "Release v${VERSION}"
git push origin "v${VERSION}"

resolve-version:
name: Resolve Version from Tag
needs: test
if: github.event_name == 'push'
if: startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
outputs:
version: ${{ steps.extract.outputs.version }}
Expand All @@ -132,11 +173,8 @@ jobs:

publish:
name: Publish to npm
needs: [test, prepare, resolve-version]
if: |
always() &&
needs.test.result == 'success' &&
(needs.prepare.result == 'success' || needs.resolve-version.result == 'success')
needs: [test, resolve-version]
if: needs.test.result == 'success' && needs.resolve-version.result == 'success'
runs-on: ubuntu-latest
environment:
name: npm-publish
Expand All @@ -145,13 +183,8 @@ jobs:
- name: Determine version
id: ver
run: |
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
echo "version=${{ needs.prepare.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.prepare.outputs.tag }}" >> $GITHUB_OUTPUT
else
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.resolve-version.outputs.tag }}" >> $GITHUB_OUTPUT
fi
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT
echo "tag=${{ needs.resolve-version.outputs.tag }}" >> $GITHUB_OUTPUT

- name: Checkout code at tag
uses: actions/checkout@v4
Expand Down Expand Up @@ -213,11 +246,8 @@ jobs:

publish-mcp-registry:
name: Publish to MCP Registry
needs: [publish, prepare, resolve-version]
if: |
always() &&
needs.publish.result == 'success' &&
(github.event_name == 'push' || inputs.publish_mcp_registry == true)
needs: [publish, resolve-version]
if: needs.publish.result == 'success'
runs-on: ubuntu-latest
permissions:
id-token: write
Expand All @@ -226,11 +256,7 @@ jobs:
- name: Determine version
id: ver
run: |
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
echo "version=${{ needs.prepare.outputs.version }}" >> $GITHUB_OUTPUT
else
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT
fi
echo "version=${{ needs.resolve-version.outputs.version }}" >> $GITHUB_OUTPUT

- name: Checkout code at tag
uses: actions/checkout@v4
Expand Down
Loading