Skip to content

Pin release action SHA, target_commitish, agent conventions - #61

Merged
ptr727 merged 2 commits into
developfrom
workflow-hardening
May 3, 2026
Merged

Pin release action SHA, target_commitish, agent conventions#61
ptr727 merged 2 commits into
developfrom
workflow-hardening

Conversation

@ptr727

@ptr727ptr727 commented May 3, 2026

Copy link
Copy Markdown
Owner

Summary

Three independent hardenings ported from the homeassistant-purpleair sibling repo, plus convention docs for future PRs:

  • Tag pinning on releases — softprops/action-gh-release is pinned to commit SHA 3bb12739 (v2.6.2) with a trailing version comment, and target_commitish: ${{ github.sha }} is set explicitly. Without it, GitHub's REST API silently retargets the new tag to the repository default branch (main) — so prerelease tags created on develop pushes were attaching to main's tip instead of the develop commit that built the artifact, leaving "Browse files" and git checkout <tag> pointing at unrelated code.
  • Merge-bot token comment — documents the GITHUB_TOKEN vs App-token recursion-guard tradeoff. No behavior change. The codegen-app job already side-steps the recursion guard via the App identity; dependabot and PAT-codegen targets feed main where releases are dispatched manually, so the missing trigger is fine there.
  • Conventions documented — AGENTS.md and .github/copilot-instructions.md now codify PR title rules (≤72 chars, imperative, no Co-Authored-By unless asked, no release-bump magnitude in title), markdown style (reference-style links, alphabetized), workflow YAML conventions (action SHA pinning + version comment, naming, concurrency, set -euo pipefail, if: >- over if: |, boolean input mirroring), and the develop=squash / main=merge branching model.

Test plan

  • CI green on the PR (test-pull-request workflow)
  • After merge to develop, observe the next prerelease tag on the Releases page — the tag's "Browse files" link should resolve to the same commit SHA that ran publish-release.yml, not main's tip
  • Markdown renders correctly on the PR page (no MD025/MD031/MD032 warnings in editor preview)
  • Subsequent PRs in this refactor series follow the new title/body/workflow conventions

@ptr727
Pin release action SHA, target_commitish, agent conventions
41daa48
Three independent hardenings ported from the homeassistant-purpleair sibling
repo:
1. Pin softprops/action-gh-release to commit SHA (v2.6.2) so a tag swap
upstream cannot change the executed code. Add target_commitish: github.sha
so release tags created on develop attach to the develop commit that built
the artifact instead of being silently retargeted to main by GitHub's REST
API default.
2. Document the merge-bot token strategy: GITHUB_TOKEN-authored pushes are
blocked by GitHub's recursion guard from triggering further workflows.
The codegen-app path uses the App identity to side-step this; dependabot
and PAT-codegen targets (which feed main where releases are dispatched
manually) are unaffected. Comment-only.
3. Extend AGENTS.md and copilot-instructions.md with: PR title and commit
message conventions, documentation style rules, workflow YAML conventions
(action SHA pinning, naming, concurrency, set -euo pipefail, if scalar
form, boolean input mirroring, target_commitish), and the develop=squash
/ main=merge branching model.
CopilotAI review requested due to automatic review settings May 3, 2026 15:16
CopilotAI reviewed May 3, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens the release workflow so created tags/releases reliably point at the exact commit that built the artifacts (especially for develop prereleases), and documents PR/workflow conventions for future contributions.

Changes:

  • Pin softprops/action-gh-release to a commit SHA and set target_commitish: ${{ github.sha }} in the reusable release workflow.
  • Add documentation to the merge-bot workflow explaining the GITHUB_TOKEN recursion-guard tradeoff (no behavior change).
  • Add/expand PR title, markdown, workflow YAML, and branching-model conventions in AGENTS.md and .github/copilot-instructions.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

FileDescription
AGENTS.mdAdds PR title/commit message, markdown, workflow YAML, and branching model conventions.
.github/workflows/merge-bot-pull-request.ymlAdds an explanatory comment describing token behavior and recursion-guard implications.
.github/workflows/build-release-task.ymlPins the release action to a SHA and explicitly sets target_commitish to the triggering commit SHA.
.github/copilot-instructions.mdAdds PR title/commit message convention section for agents.

Comment thread.github/copilot-instructions.md Outdated
Comment threadAGENTS.md Outdated
Comment thread.github/workflows/merge-bot-pull-request.yml Outdated
Comment threadAGENTS.md Outdated
Comment threadAGENTS.md
@ptr727
Address Copilot review on PR#61
68a1524
- Use US English `summarizing` instead of `summarising` in the new PR-title
rule (AGENTS.md, copilot-instructions.md). The rule text itself mandates US
spelling, so the example was self-contradictory.
- Fix the merge-bot token-strategy comment: all three merge jobs target
`main` per their `if:` conditions, not `develop`. The original draft
incorrectly described App-codegen as merging to `develop`.
- Soften the workflow-conventions intro to clarify the rules are a target
state migrated opportunistically, not a backlog of tickets to apply across
every existing workflow at once.
- Rename three steps in `github-release` from `... job` to `... step` so the
step-naming convention is actually true on the file the same PR touches.
@ptr727
ptr727 merged commit d07d010 into developMay 3, 2026
20 checks passed
@ptr727
ptr727 deleted the workflow-hardening branch May 3, 2026 18:02
@ptr727ptr727 mentioned this pull request May 4, 2026
Merged
5 tasks
ptr727 added a commit that referenced this pull request May 4, 2026
@ptr727
Pin release action SHA, target_commitish, agent conventions (#61)
55082f7
## Summary
Three independent hardenings ported from the `homeassistant-purpleair`
sibling repo, plus convention docs for future PRs:
- **Tag pinning on releases** — `softprops/action-gh-release` is pinned
to commit SHA `3bb12739` (v2.6.2) with a trailing version comment, and
`target_commitish: ${{ github.sha }}` is set explicitly. Without it,
GitHub's REST API silently retargets the new tag to the repository
default branch (`main`) — so prerelease tags created on `develop` pushes
were attaching to `main`'s tip instead of the develop commit that built
the artifact, leaving "Browse files" and `git checkout <tag>` pointing
at unrelated code.
- **Merge-bot token comment** — documents the `GITHUB_TOKEN` vs
App-token recursion-guard tradeoff. No behavior change. The codegen-app
job already side-steps the recursion guard via the App identity;
dependabot and PAT-codegen targets feed `main` where releases are
dispatched manually, so the missing trigger is fine there.
- **Conventions documented** — `AGENTS.md` and
`.github/copilot-instructions.md` now codify PR title rules (≤72 chars,
imperative, no `Co-Authored-By` unless asked, no release-bump magnitude
in title), markdown style (reference-style links, alphabetized),
workflow YAML conventions (action SHA pinning + version comment, naming,
concurrency, `set -euo pipefail`, `if: >-` over `if: |`, boolean input
mirroring), and the develop=squash / main=merge branching model.
## Test plan
- [ ] CI green on the PR (test-pull-request workflow)
- [ ] After merge to develop, observe the next prerelease tag on the
Releases page — the tag's "Browse files" link should resolve to the same
commit SHA that ran `publish-release.yml`, not `main`'s tip
- [ ] Markdown renders correctly on the PR page (no MD025/MD031/MD032
warnings in editor preview)
- [ ] Subsequent PRs in this refactor series follow the new
title/body/workflow conventions
ptr727 added a commit that referenced this pull request May 11, 2026
@ptr727
Add PyPiLibrary, Per-Language Devcontainers, Signing Docs, NuGet Rena…
ffcb754
…me (#66)
Release merge: brings five squashed PRs from develop into main.
## Squashed PRs included
- **#61 — Pin release action SHA, target_commitish, agent conventions.**
`softprops/action-gh-release` pinned to a commit SHA with
`target_commitish: ${{ github.sha }}` so the release tag lands on the
artifact's commit, not the default branch. Updated `AGENTS.md` workflow
YAML conventions.
- **#62 — Rename Library project to NuGetLibrary.** Project + folder
renamed; `.slnx`, `.csproj`, build workflow, and references updated.
Disambiguates from the new Python sibling.
- **#63 — Add devcontainer + per-OS host and SSH signing docs.** New
`docs/host-setup.md`, `docs/ssh-signing.md`, `docs/devcontainer.md`.
Devcontainer bind-mounts SSH public key, allowed_signers, and `gh`
config so commits sign correctly inside the container.
- **#64 — Add PyPiLibrary Python sibling project.** New `PyPiLibrary/`
template under `src/`-layout: pyproject.toml + uv.lock +
ruff/pyright/pytest config + sample module + tests +
`build-pypilibrary-task.yml` workflow + `publish-pypi` job in
`publish-release.yml`.
- **#65 — Split Devcontainer and Workspace per Language and Drop
Husky.** `.devcontainer/dotnet/` + `DotNet.code-workspace` and
`.devcontainer/python/` + `Python.code-workspace`. Husky.Net removed (CI
is the lint backstop). Optional opt-in hooks documented in README. All
Husky references removed from workflows, AGENTS, CODESTYLE, and tasks.
## Notes
- Merge method: **merge-commit** (per [AGENTS.md branching
model](https://github.com/ptr727/ProjectTemplate/blob/develop/AGENTS.md#branching-model)).
Squash and rebase are blocked by the main ruleset.
- Main currently has 6 codegen-update commits that develop doesn't have
(#58, #59, #60 etc.). The merge-commit re-anchors develop on top of
those; the next develop cycle will start by merging main back into
develop to absorb them.
## Test plan
- [ ] CI passes on the merge commit (test-release-task workflow, all
build matrix legs).
- [ ] Confirm release tag lands on the merge commit (target_commitish
from #61).
- [ ] Spot-check the new `.devcontainer/dotnet/` and
`.devcontainer/python/` open and build cleanly.
- [ ] Spot-check `cd PyPiLibrary && uv sync && uv run pytest` passes.
- [ ] Confirm `.git/hooks/pre-commit` is absent in a fresh clone (Husky
removed).
@ptr727ptr727 mentioned this pull request Aug 8, 2026
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ptr727