publish-release: gate auto-publish to bot merges on main only (release-model) - #388
Conversation
A human PR merge no longer auto-cuts a release. On a push (main-only, release-affecting paths) the release runs only for a bot merge - the codegen App merges every Dependabot/codegen PR, so its identity gates it; a human merge/promotion skips and the maintainer dispatches when ready. Narrow the push trigger to main so bot merges to develop don't release; develop prereleases come via dispatch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@## develop #388 +/- ##
========================================
Coverage 40.62% 40.62% ========================================
Files 10 10 Lines 1024 1024 Branches 99 99 ========================================
Hits 416 416 Misses 580 580 Partials 28 28 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Updates the release publishing workflow to align with the new release model: auto-publishing happens only on bot-driven merges to main, while human merges and develop prereleases require an explicit manual dispatch.
Changes:
- Narrow
on.push.branchesto[main]so pushes todevelopno longer auto-publish. - Gate the
publishjob sopush-triggered publishes run only whengithub.actoris an allowed bot actor; allowworkflow_dispatchpublishes formain/develop. - Update workflow header/policy comments to describe the new release behavior.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…bot) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…task) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…ch serves Docker) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… inherit secrets: inherit passes every secret, so singling out CODECOV_TOKEN is misleading noise. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
Promotion of `develop` -> `main`. Carries: - **#388** — gated release model: `publish-plan-task.yml` (plan job) + gated `publish-release.yml` (a human merge never auto-publishes; only a bot code-merge to main, or a dispatch, does) + codecov-comment cleanup. - **#389** — `Directory.Packages.props` nuget-deps bump. **This promotion is also the live gate test.** The diff touches `Directory.Packages.props` (a release-affecting path), so on merge the now-gated `publish-release.yml` will trigger — and because the promotion is a **human** merge (`github.actor = ptr727`), the `plan` job resolves `publish=false` and **skips the publish**. That proves a human merge/promotion does not auto-cut a release. (The next Dependabot/codegen merge to `main` — `actor = ptr727-codegen[bot]` — will publish.) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Part of the fleet release-model change: a human PR merge never auto-cuts a release; only a bot (Dependabot/codegen) code-merge to
maindoes, plus manual dispatch.pushtrigger narrowed to[main]— bot merges todevelopno longer release;developprereleases come viaworkflow_dispatch.github.actor == 'ptr727-codegen[bot]'(the App merges every bot PR) /dependabot[bot], so a human merge/promotion tomainskips — the maintainer dispatches when release-ready. Thepaths:filter still means an Actions-only bump publishes nothing.ptr727).Header/comment updated to match. Takes effect on
mainonce promoted. Companion to LanguageTags #255; template docs (WORKFLOW.md/AGENTS.md) +PUBLISH_ON_MERGEdeletion follow.🤖 Generated with Claude Code