DRIVERS-3601 Add a unified release workflow with semver tagging and GitHub Releases - #115
Conversation
- Replace delete-then-recreate v3 tag handling with force-tag + force-push to avoid a window where the remote v3 tag is deleted but recreation can fail (local v3 already exists due to fetch-depth: 0), which would leave v3 consumers broken. - Capture next-version.sh stderr separately and surface it in the job summary so the bootstrap-mode notice (major bump silently ignored when no vX.Y.Z tags exist yet) is visible to the operator.
|
Semgrep found 3 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. 🛟 Help? Slack #semgrep-help or go/semgrep-help. Resolution Options:
|
There was a problem hiding this comment.
Pull request overview
Adds a unified, dispatchable release workflow that computes the next semver version, optionally bumps the major-version file, creates signed tags, and publishes a GitHub Release—replacing the older floating-tag-only workflow and documenting the v3→v4 floating-tag change for consumers.
Changes:
- Introduces
.github/workflows/release.ymlto drive semver tagging + GitHub Releases with adry_runmode and optional floatingv3tag update. - Retires
.github/workflows/update-action-tag.ymlin favor of a single release entrypoint. - Adds bash scripts + CI tests to compute the next version and bump the major-version file; updates docs to reflect the new process and tagging policy.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents floating major tag policy through v3 and immutable semver tags starting v4. |
| CONTRIBUTING.md | Updates contributor release instructions to use the new Release workflow. |
| .github/workflows/update-action-tag.yml | Removes the legacy floating-tag update workflow. |
| .github/workflows/release.yml | Adds the unified release workflow: version calculation, optional major bump, signed tags, and GitHub Release creation. |
| .github/workflows/ci.yml | Adds CI job to run tests for the new release scripts. |
| .github/scripts/next-version.sh | Implements next semver computation based on existing tags (with bootstrap from floating major tag). |
| .github/scripts/next-version.test.sh | Adds tests for next-version logic (bootstrap, patch/minor/major, sorting, invalid input). |
| .github/scripts/bump-major-version.sh | Writes the major component of a semver version into version.txt (or provided file). |
| .github/scripts/bump-major-version.test.sh | Adds tests for bump-major-version behavior and error handling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Jérôme Tamarelle <jerome.tamarelle@mongodb.com>
There was a problem hiding this comment.
🟡 Changes recommended
Bootstrap failures, concurrent release races, and the lack of a safe retry path can leave releases incomplete or tags inconsistent.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 3
- Review effort level: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
Non-atomic pushes can leave partially published releases that cannot be safely retried.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.github/workflows/release.yml:85
- For v3 releases, this pushes the immutable version tag before the floating
v3tag is created and pushed. A signing or push failure afterward leaves the version tag allocated without a GitHub Release, and rerunning computes the next version; the recovery message below only handles release-creation failures. Create both tags before atomically pushing them, or add an explicit completion path for this partial state.
push_tag: ${{ inputs.dry_run == false }}
- Files reviewed: 9/9 changed files
- Comments generated: 1
- Review effort level: Balanced
| with: | ||
| version: ${{ env.NEXT_VERSION }} | ||
| version_bump_script: "bash .github/scripts/bump-major-version.sh" | ||
| push_commit: ${{ inputs.dry_run == false }} |
GromNaN
left a comment
GromNaN
left a comment
There was a problem hiding this comment.
LGTM.
You should squash-merge this PR; the commits are not relevant.
Summary
release.ymlworkflow that bumps the version (patch, minor, or major), creates a signed release tag, and publishes a GitHub Release with generated notes.v3tag in sync while major version 3 is supported, then warn once a release no longer needs it.update-action-tag.yml, leaving one supported release process.Why
Releasing this repo today only moves a floating major-version tag to the tip of
main, so there's no documented, reproducible release. Semgrep'sgithub-actions-mutable-action-tagrule flags that floating tag as a supply-chain risk. See DRIVERS-3601.Test plan