Uh oh!
There was an error while loading. Please reload this page.
feat: publish agent releases via go-github instead of gh CLI (#457) - #462
Merged
antoinetoussaint-byte merged 3 commits intoAug 23, 2026
Conversation
Replace the `gh release` subprocess in agent-release publishing with go-github calls (GetReleaseByTag / CreateRelease / delete-then-upload assets), so the `gh` binary is no longer required on release hosts when a token is present. Lift the shared client/token plumbing into pkg/gh so release publishing and version listing resolve credentials one way. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…upload (#457) Address review findings on the go-github migration: - The publisher→owner rule (dots→dashes) was copied in three places (loaderDownloadURL, agentReleaser.afterPush, agents.githubSource). A drift between any copy and core's manager.DownloadURL would silently send an upload to a repo installers never read. Lift it to a single gh.Owner so the release upload/verify path and the install resolver can't diverge. - The new release-upload tests never staged an SBOM, leaving the asset.sbomPath branch (second per-asset upload + its clobber) uncovered. Add tests that stage archive+SBOM and assert both upload, and both are deleted-then-uploaded when pre-existing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
golangci-lint govet flagged the releaser assignments in run/runReTag for shadowing the outer err. Pre-declare releaser and assign with = so the function-level err is reused. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
antoinetoussaint-byte
deleted the
issue-457-migrate-agent-release-publishing-from-gh-cli-to
branch
August 23, 2026 21:47
antoinetoussaint-byte added a commit
that referenced
this pull request
Aug 23, 2026
Completes the go-github standardization for the platform (REST API) operations that #457 (agent-release publishing, merged in #462) did not cover, reconciled onto the shared pkg/gh helper that #462 introduced rather than the separate pkg/github this work originally added: - pkg/gitops/publish.go: promotion pull-request list/create/edit/verify move from `gh pr *` to PullRequests.List/Create/Edit/Get. - cmd/status/release.go: chore issue creation moves from `gh issue create` to Issues.Create. - pkg/librarystore/github.go: a first-ever library publish now creates the target repo via Repositories.Get-then-Create when the clone fails, instead of erroring; content publishing stays on git. - pkg/gh: gains RepoAtDir/ParseRemote (owner/repo from the origin remote) alongside the existing NewClient/Token/Owner. Deliberately unchanged: pkg/gitops/observe.go still reads reviewDecision through `gh` — a GraphQL-only field with no REST equivalent; deriving it from REST review lists would weaken the promotion security gate. Git content ops (clone/add/commit/tag/push) stay on the git binary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4 tasks
antoinetoussaint-byte added a commit
that referenced
this pull request
Aug 23, 2026
Completes the go-github standardization for the platform (REST API) operations that #457 (agent-release publishing, merged in #462) did not cover, reconciled onto the shared pkg/gh helper that #462 introduced rather than the separate pkg/github this work originally added: - pkg/gitops/publish.go: promotion pull-request list/create/edit/verify move from `gh pr *` to PullRequests.List/Create/Edit/Get. - cmd/status/release.go: chore issue creation moves from `gh issue create` to Issues.Create. - pkg/librarystore/github.go: a first-ever library publish now creates the target repo via Repositories.Get-then-Create when the clone fails, instead of erroring; content publishing stays on git. - pkg/gh: gains RepoAtDir/ParseRemote (owner/repo from the origin remote) alongside the existing NewClient/Token/Owner. Deliberately unchanged: pkg/gitops/observe.go still reads reviewDecision through `gh` — a GraphQL-only field with no REST equivalent; deriving it from REST review lists would weaken the promotion security gate. Git content ops (clone/add/commit/tag/push) stay on the git binary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes#457.
Summary
gh release create/gh release upload --clobber/gh release viewfor pure GitHub REST operations. These now go through the already-presentgithub.com/google/go-github/v89client, so theghbinary is no longer required on a release host when a token is available via env.--clobbersemantics are preserved: an existing same-named asset (archive and SBOM) is deleted before re-upload (the GitHub API rejects a duplicate asset name).pkg/ghpackage so agent-release publishing andagent versions/listresolve credentials and repo owners one way. Thegh auth tokenfallback stays, so local dev keeps working without exporting a token —ghis now a credential-only, optional dependency.Genuine git operations (release tags via
git tag/git push) are untouched, per the issue's out-of-scope note.Behavior changes (intentional)
ghresolved the repo from the working dir'soriginremote; the new code computesowner/reg.GitHubRepository(name)— the same mappingverifyReleaseAssetsand core'smanager.DownloadURL(the install resolver) already use, pinned byTestLoaderArchiveName_MatchesInstallResolver. This is strictly more consistent (the old path could upload tooriginthen fail verification against the canonical URL), but publishing from a fork/mirror whoseorigindiffers from the canonicalowner/service-<name>repo now targets the canonical repo.ghbinary on PATH. A host withghinstalled but logged out (or a token lackingcontents:write) now fails fast at the validate phase with a clear "GitHub token is required" message instead of after the expensive CI run. Hosts that setGITHUB_TOKEN/GH_TOKENor have an authenticatedghare unaffected.Test plan
go build ./...go vet ./cmd/publish/... ./cmd/agents/... ./pkg/gh/...go test ./cmd/publish/... ./cmd/agents/... ./pkg/gh/...pkg/ghtests cover token precedence (env over env,ghfallback, empty), authenticated/anonymous client construction, and theOwnerpublisher→owner mapping.createAndUploadReleasetests (fake GitHub server) cover create-when-absent, the clobber path (delete-then-upload of a same-named asset), and the SBOM branch — both uploaded alongside the archive and both clobbered when pre-existing.Note:
make lint(golangci-lint) could not run locally — the installed golangci-lint is built with Go 1.26 while the repo targets 1.27; CI runs the real lint.