From 412f5947437e2995f5af5989b4825f03300124f0 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:31:58 +0300 Subject: [PATCH 1/4] Clarify Marketplace release handoff --- .github/workflows/publish-release.yml | 2 +- CHANGELOG.md | 5 ++++ docs/releasing.md | 36 ++++++++++++++++----------- package.json | 2 +- 4 files changed, 28 insertions(+), 17 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 5c9594e..a4d458a 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -130,7 +130,7 @@ jobs: payload="$(jq -nc \ --arg tag "$RELEASE_TAG" \ --arg url "$RELEASE_URL" \ - '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Publish it in GitHub Marketplace (Deployment, Security).\n• Verify the listing and complete the caller canary before moving `v1`.")}')" + '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Complete the caller canary before moving `v1`.")}')" curl --fail-with-body --silent --show-error \ --request POST \ --header 'Content-type: application/json' \ diff --git a/CHANGELOG.md b/CHANGELOG.md index 4abbbcf..5904f88 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,11 @@ All notable changes to this action are recorded here. Versions follow semantic versioning; callers should normally use the maintained `v1` major tag. +## v1.0.4 - 2026-08-24 + +- Clarified the one-time GitHub Marketplace setup and the checks required for + each subsequent action release. + ## v1.0.3 - 2026-08-18 - Added release verification, workflow linting, and a production release diff --git a/docs/releasing.md b/docs/releasing.md index 3c09978..52cf472 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -18,9 +18,9 @@ nothing unless that push changes the `package.json` version; then it runs release from the merged commit. It explicitly dispatches `Verify release` for the published tag, because release events created with `GITHUB_TOKEN` do not start other workflows. -After the GitHub release is created, `#rabbit-support` receives the Marketplace -handoff through `SLACK_WEBHOOK_RABBIT_SUPPORT`; the message directs the -operator to wait for verification before publishing to Marketplace. +After the GitHub release is created, `#rabbit-support` receives a handoff +through `SLACK_WEBHOOK_RABBIT_SUPPORT` to wait for verification and check the +Marketplace listing. `package.json` is the single release-version source. Its semantic version maps to the Git tag by adding `v` and must match the first semantic heading in @@ -28,20 +28,26 @@ to the Git tag by adding `v` and must match the first semantic heading in published. A production push creates a release only when this version changes, and its version must increase. -## Publish to GitHub Marketplace +## GitHub Marketplace -1. Confirm the `Verify release` workflow passed for the automatically - published semantic GitHub release, for example `v1.0.3`. -2. Open that release and, in the release form, select **Publish this Action to - the GitHub Marketplace**. GitHub requires this UI step and may require 2FA; - a release created only through the REST or CLI release API is not enough. -3. Keep `Deployment` as the primary Marketplace category and `Security` as the - secondary category unless the action's public purpose changes. -4. Verify the Marketplace listing shows the new version, current `action.yml` - metadata, and current README before changing any caller references. +Publishing an action to GitHub Marketplace is a one-time UI setup. This action +already has a Marketplace listing, so a published versioned release updates the +existing listing without another manual publishing step. -The published-tag verification does not replace the pre-release caller canary -or the Marketplace UI verification. +For the first Marketplace release only, open the release form and select +**Publish this Action to the GitHub Marketplace**. GitHub may require 2FA. +Use `Deployment` as the primary category and `Security` as the secondary +category unless the action's public purpose changes. + +For every release: + +1. Confirm `Verify release` passed for the published semantic tag, for example + `v1.0.4`. +2. Confirm the Marketplace listing shows that version, the current `action.yml` + metadata, and the current README. + +Published-tag verification does not replace the pre-release caller canary or +the Marketplace listing check. ## Promote callers diff --git a/package.json b/package.json index 65a9cdf..70cb43f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@udx/github-rabbit-action", - "version": "1.0.3", + "version": "1.0.4", "private": true, "description": "Rabbit Automation Action release manifest", "license": "GPL-2.0-only", From 2148fa3e7c5a274d620194039287d574f040798f Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:44:59 +0300 Subject: [PATCH 2/4] Clarify caller canary --- .github/workflows/publish-release.yml | 2 +- .rabbit/repo.yaml | 2 ++ docs/releasing.md | 18 ++++++++++-------- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index a4d458a..30cb488 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -130,7 +130,7 @@ jobs: payload="$(jq -nc \ --arg tag "$RELEASE_TAG" \ --arg url "$RELEASE_URL" \ - '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Complete the caller canary before moving `v1`.")}')" + '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Run a non-production caller plan with `@production`, then move `v1`.")}')" curl --fail-with-body --silent --show-error \ --request POST \ --header 'Content-type: application/json' \ diff --git a/.rabbit/repo.yaml b/.rabbit/repo.yaml index 6118844..40bd427 100644 --- a/.rabbit/repo.yaml +++ b/.rabbit/repo.yaml @@ -9,6 +9,8 @@ branches: rules: {} - name: chore/publish-versioned-releases rules: {} + - name: docs/clarify-marketplace-releases + rules: {} - name: fix/dispatch-release-verification rules: {} - name: fix/gcp-credential-mount diff --git a/docs/releasing.md b/docs/releasing.md index 52cf472..662d3d4 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -9,8 +9,6 @@ The action is released from `production`. Patch releases are immutable user-facing notes at the top of `CHANGELOG.md` in the pull request that changes action behavior. 2. Merge the focused, reviewed pull request into `production`. -3. Test the exact `production` commit from a caller's non-production - environment. Use `@production` only for that canary. The `Publish release` workflow runs after every `production` push. It does nothing unless that push changes the `package.json` version; then it runs @@ -46,16 +44,20 @@ For every release: 2. Confirm the Marketplace listing shows that version, the current `action.yml` metadata, and the current README. -Published-tag verification does not replace the pre-release caller canary or -the Marketplace listing check. +Published-tag verification does not replace the caller canary or the +Marketplace listing check. ## Promote callers -1. Move the `v1` tag to the tested immutable release commit. -2. Confirm `v1` and the patch tag resolve to the same commit with +1. In a caller repository's non-production environment, run a plan using + `udx/github-rabbit-action@production`. This caller canary proves the exact + release commit works in a real consumer workflow; it must not apply + infrastructure. +2. Move the `v1` tag to the tested immutable release commit. +3. Confirm `v1` and the patch tag resolve to the same commit with `git ls-remote --tags origin 'v1*'`. -3. Update reusable workflows and callers from `@production` to `@v1`. -4. Run a non-production caller plan using `@v1` before merging the consumer +4. Update reusable workflows and callers from `@production` to `@v1`. +5. Run a non-production caller plan using `@v1` before merging the consumer change. Use a new major tag for breaking input, output, safety, or lifecycle-contract From 89041e5bf7faf900296d71589595dd8feaff9ff1 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Tue, 25 Aug 2026 13:50:19 +0300 Subject: [PATCH 3/4] Clarify release canary handoff --- .github/workflows/publish-release.yml | 2 +- CHANGELOG.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 30cb488..2b8a216 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -130,7 +130,7 @@ jobs: payload="$(jq -nc \ --arg tag "$RELEASE_TAG" \ --arg url "$RELEASE_URL" \ - '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Run a non-production caller plan with `@production`, then move `v1`.")}')" + '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Run a plan-only non-production caller canary with `@production`, then move `v1`.")}')" curl --fail-with-body --silent --show-error \ --request POST \ --header 'Content-type: application/json' \ diff --git a/CHANGELOG.md b/CHANGELOG.md index 5904f88..f8f1d62 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ versioning; callers should normally use the maintained `v1` major tag. ## v1.0.4 - 2026-08-24 - Clarified the one-time GitHub Marketplace setup and the checks required for - each subsequent action release. + each subsequent action release. No action runtime behavior changed. ## v1.0.3 - 2026-08-18 From 8337f571a23fe7984a433634ee5e103184f40ead Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Tue, 25 Aug 2026 13:54:36 +0300 Subject: [PATCH 4/4] Expand Marketplace handoff check --- .github/workflows/publish-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 2b8a216..70f7e8f 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -130,7 +130,7 @@ jobs: payload="$(jq -nc \ --arg tag "$RELEASE_TAG" \ --arg url "$RELEASE_URL" \ - '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace lists this version.\n• Run a plan-only non-production caller canary with `@production`, then move `v1`.")}')" + '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Verify Marketplace shows this version and current metadata/README.\n• Run a plan-only non-production caller canary with `@production`, then move `v1`.")}')" curl --fail-with-body --silent --show-error \ --request POST \ --header 'Content-type: application/json' \