Conversation
#274) Canonical reusable workflow encoding the publish-plan policy (human merge never auto-publishes).
Reference comment structure for the fleet workflow rework.
Aligns AGENTS.md + WORKFLOW.md to the gated single-branch release model (delete PUBLISH_ON_MERGE), and corrects the stale build-release-task.yml branch comment to match.
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes recent develop governance/workflow updates to main, centering on a single-source “publish plan” decision snippet and aligning release-model documentation and workflow comments to that model.
Changes:
- Add
publish-plan-task.ymlcatalog snippet to centralize the release-gate decision (publish/stable outputs). - Update release-model documentation in
WORKFLOW.mdandAGENTS.mdto describe gated single-branch publishing. - Refine workflow comments for concision/structure (merge-bot and publish-release).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| WORKFLOW.md | Updates release-model narrative and expected-outcomes scenarios to describe a gated publish plan. |
| AGENTS.md | Updates foundational/release-model guidance to reflect the “human merge never auto-publishes” gate. |
| catalog/snippets/workflows/README.md | Documents the new publish-plan reusable workflow snippet. |
| catalog/snippets/workflows/publish-plan-task.yml | Adds the reusable workflow that computes publish/stable outputs from event/actor/ref. |
| catalog/snippets/workflows/build-release-task.yml | Updates inline documentation to reflect single-branch publish runs (no branch matrix). |
| .github/workflows/publish-release.yml | Minor comment edits in the source-only publisher workflow. |
| .github/workflows/merge-bot-pull-request.yml | Restructures header/concurrency comments into the approved minimal bullet style. |
| ### Release Model | ||
| Each publish builds a **single branch** - the trigger ref (`main` a release, `develop` a prerelease) - so there is no branch matrix and `github.ref` always names the built branch. A **Docker or package** repo self-releases the pushed branch on a release-affecting push to `main` or `develop` (a shared paths filter, so a non-substantive change like a GitHub Actions bump publishes nothing), refreshes the released image on a **main-only weekly schedule**, and publishes on manual dispatch. A **source-only** repo publishes on **manual dispatch only**. Every release is a tag on the built commit plus a source archive, README, and LICENSE; targets amend it with `release-asset-*` files or push to their own registry. An unchanged version re-pushes nothing (no-op republish); Docker re-pushes by design. | ||
| Each publish builds a **single branch** - the trigger ref (`main` a release, `develop` a prerelease) - so there is no branch matrix and `github.ref` always names the built branch. A **human merge never auto-publishes**: a first `plan` job (`publish-plan-task.yml`) decides once and every job gates on it. A run publishes on a **code-affecting bot push to `main`** (the App merges every Dependabot/codegen PR, so `github.actor` gates it; a shared paths filter also drops a non-substantive change like an Actions bump), a **manual dispatch** of `main`/`develop`, or a **main-only weekly schedule** (Docker, to refresh the base image). The `push` is main-only, so a develop bot merge publishes nothing (its prerelease comes via dispatch). A **source-only** repo publishes on **dispatch only**. Every release is a tag on the built commit plus a source archive, README, and LICENSE; targets amend it with `release-asset-*` files or push to their own registry. An unchanged version re-pushes nothing (no-op republish); Docker re-pushes by design. |
| - **PRs smoke-test only.** [`test-pull-request.yml`](./.github/workflows/test-pull-request.yml) always runs unit tests, then a `dorny/paths-filter` `changes` job gates a **reduced** build of only the changed targets (Docker `linux/amd64` only, executable on a representative runtime subset), never pushing. Build-workflow files are intentionally not in the path filters - a filter can't tell a logic change from an action-version bump - so a workflow-only change isn't smoke-built; the reusable workflows are exercised by the next run that uses them (a later code PR's smoke build, or the scheduled/publish run). Workflow YAML is still linted in CI by the lint job's `actionlint` step; also run `actionlint` locally before pushing to catch issues early. | ||
| - **Merges don't publish by default.** [`publish-release.yml`](./.github/workflows/publish-release.yml) is the sole publisher: its **weekly schedule** (Mondays 02:00 UTC) and **manual `workflow_dispatch`** always do the full build/publish of **both** `main` and `develop` (a branch matrix). Its `push` trigger publishes only when the **`PUBLISH_ON_MERGE` repository variable** is `true` (opt-in legacy continuous-release). Unset/`false` = two-phase. | ||
| - **A human merge never auto-publishes.** [`publish-release.yml`](./.github/workflows/publish-release.yml) is the sole publisher; each run builds the **single trigger branch** (`main` a release, `develop` a prerelease). A first [`plan`](./catalog/snippets/workflows/publish-plan-task.yml) job decides once whether the run publishes and every other job gates on its output. It publishes on a **`workflow_dispatch`** of `main`/`develop` (the human-initiated release), a **code-affecting bot push to `main`** (the codegen App merges every Dependabot/codegen PR, so `github.actor` is the gate - a human merge/promotion to `main` skips), or a **weekly `schedule`** (Docker only, to refresh the base image). The `push` is main-only and paths-filtered, so a develop bot merge and an Actions-only bump publish nothing. A source-only repo publishes on dispatch only. |
Comment on lines
+67
to
+70
| schedule) | ||
| # Docker weekly refresh (main-only by schedule config). | ||
| publish=true | ||
| ;; |
| uses: dotnet/nbgv@master | ||
| # Skip create on an existing tag (no-op republish); a re-dispatch refreshes it. | ||
| # Skip create on an existing tag (no-op republish). A re-dispatch refreshes it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward promotion of #274 + #275 + #277 (and prior develop work). No release.