Repository navigation
feat(ci): publish a release when its release PR merges - #1651
Merged
Merged
Conversation
added 2 commits
October 28, 2026 02:33
Since #1594 moved CI to the maintainer machine, release.yml ran only on a pushed publish-* tag, so every release needed scripts/release.sh after the merge. CI is back on Actions, so release.yml now also runs on workflow_run when the CI workflow completes green for a push to main, checks out that exact commit, and publishes the changelog files it added: npm, GitHub Packages, the GitHub Releases (back in the workflow with contents: write) and the lockstep wrappers. The changelog diff runs before setup and install, so a push with no changelog file costs a checkout and a git diff. One run per commit through a concurrency group, so an automatic run and a manually pushed tag queue instead of racing. The tag and dispatch triggers stay as the manual and recovery paths. The repo-health test pins every property whose loss would stop releases or publish the wrong commit, each with a counterfactual. Closes #1650
framework-dev.md, AGENTS.md, the start-work skill, ci-merge.sh, release.sh and the global-update hook described the manual release.sh flow as the only way to publish. The release gate now runs on the release PR head before the merge, the publish follows CI on the merge commit, and release.sh is the manual fallback. Refs #1650
|
Preview for Next: fix the listed keys in the compose file |
This was referenced Oct 28, 2026
vivek7405
added a commit
that referenced
this pull request
Oct 28, 2026
* ci: purge the CDN on Actions for every push to main again #1594 moved the webjs.dev purge from purge-cdn.yml to the merging machine, where ci-merge.sh started scripts/purge-cdn.sh in the background. That skipped silently whenever the shell lacked CLOUDFLARE_API_TOKEN or held an expired Railway login, and never ran for a merge done anywhere else; the purges for #1649 and #1651 both failed that way. CI is on Actions again and the repository secrets are still set, so the workflow's push trigger comes back unchanged. ci-merge.sh no longer starts a local purge, release.sh purges only with --purge, and purge-cdn.sh stays as the manual tool. Closes #1652 * docs: point purge-cdn.sh at the automatic workflow --------- Co-authored-by: t <t@t>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1650
A merged release PR publishes on its own again.
release.ymlnow also runs onworkflow_runwhen theCIworkflow completes green for a push tomain, checks out that exact commit, and publishes the changelog files it added: npm, GitHub Packages, the GitHub Releases, and the lockstep wrappers.scripts/release.shand thepublish-*tag stay as the manual and recovery paths.Why it was manual
#1594 moved CI off Actions onto the maintainer machine and left Actions only the npm publish (trusted publishing is bound to
release.yml), so the rest of the release moved toscripts/release.sh. CI has since moved back to Actions andscripts/ci-merge.shwaits for it, so the release can follow CI on the merge commit, which is the same checkrelease.shmade by hand.Guards
if:).workflow_run.head_sha, not the current tip ofmain, soHEAD~1..HEADis the release commit even if main moved on.git diff.concurrency: release-<sha>queues an automatic run and a manually pushed tag for the same commit.test/repo-health/release-workflow-trigger.test.mjspins all of that, including thatworkflow_run.workflowsequals thename:ofci.yml; each of the eight properties was broken in turn and turned the test red.Process change
The release gate (
node scripts/release-gate.mjs) now runs on the release PR head before merging (as done for #1649) rather than inrelease.shafter it. Docs updated:framework-dev.md,AGENTS.md, the start-work skill,ci-merge.sh,release.sh, the global-update hook.Caveat
workflow_runreads the workflow file from the default branch, so this takes effect for release merges after it lands. Trusted publishing from aworkflow_run-triggered run of the samerelease.ymlfile is the one thing only a real release can prove; if the first one does not publish,scripts/release.shstill works unchanged.