Skip to content

feat: release-publish-git — the OCI chain's sibling for git-clone repos - #97

Closed
sebasnallar wants to merge 1 commit into
mainfrom
feat/release-publish-git
Closed

feat: release-publish-git — the OCI chain's sibling for git-clone repos#97
sebasnallar wants to merge 1 commit into
mainfrom
feat/release-publish-git

Conversation

@sebasnallar

Copy link
Copy Markdown
Contributor

What

`release-publish-git.yml`: the `release-publish-oci` chain for repositories whose deliverable is the repository — the service repos the agent git-clones (services-s-3, services-endpoint-exposer, services-postgresql-rds are the immediate adopters; caller PRs open alongside this one).

One chained run: release-please → `np artifact create --type git_repository --url --reference ` → release finalized with a Repository / Reference / Commit / Artifact-ID table and pulled out of draft.

Same conventions as the OCI chain, deliberately:

  • `ARTIFACT_NP_API_KEY` secret + `NP_ARTIFACT_NRN` repo/org variable; `artifact_visible_to` defaults to `organization=*`
  • `existing_tag` input for recovery/backfill of already-cut tags
  • declared-choice errors (missing wiring fails loudly, never a silent green)
  • idempotent release-body append; `draft=false` repairs orphaned drafts
  • `np_cli_version` pin input (default `alpha-packages`, same as OCI)

Differences from OCI, because there's nothing to push: no `id-token`/preflight, no docker jobs — just release + finalize.

🤖 Generated with Claude Code

Service/scope repositories whose deliverable IS the repository (specs,
workflows, scripts — no image) get the same one-run chain: release-please
cuts the version, the same run registers a git_repository artifact
pinning the tag (np artifact create --type git_repository --url
--reference, visible-to organization=* by default), and the release gets
its Repository/Reference/Commit/Artifact-ID table and leaves draft.

Same conventions as release-publish-oci: ARTIFACT_NP_API_KEY secret,
NP_ARTIFACT_NRN variable, existing_tag recovery path, declared-choice
errors instead of silent skips, idempotent release-body append. No
id-token needed — there is no registry push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@sebasnallar

Copy link
Copy Markdown
Contributor Author

Closing: the three service repos ship worker IMAGES after all (Pao provisioned their ECR Public repos + publisher roles in iac-null-runtime#109), so they adopt the existing release-publish-oci chain instead — no git_repository flavor needed. Branch kept in case a git-clone-only repo ever wants this.

@sebasnallar sebasnallar closed this Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant