Skip to content

fix(release): serialize canonical draft creation #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
syzsunshine219 merged 1 commit into from
Aug 18, 2026
Merged

fix(release): serialize canonical draft creation #258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions .github/workflows/github-draft-release-v2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: GitHub Draft Release v2

on:
# Use the base repository's trusted workflow so release PRs from forks can
# create an auditable Draft Release without executing untrusted fork code.
# Use the base repository's trusted workflow and admit only its canonical
# release branches in the job guard below.
pull_request_target:
types: [closed]
branches: [main]
Expand Down Expand Up @@ -34,17 +34,19 @@ permissions:
contents: write
pull-requests: read

concurrency:
group: draft-release-v2-${{ github.event_name == 'workflow_dispatch' && format('v{0}', inputs.version) || github.event.pull_request.head.ref }}
cancel-in-progress: false

jobs:
release:
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event.pull_request.merged == true &&
(startsWith(github.event.pull_request.head.ref, 'v') ||
startsWith(github.event.pull_request.head.ref, 'release/v')))
github.event.pull_request.head.repo.full_name == github.repository &&
startsWith(github.event.pull_request.head.ref, 'release/v'))
concurrency:
# Tag and Draft Release mutations are repository-global. Queue automatic
# and manual recovery runs so they cannot mutate assets concurrently.
group: draft-release-v2
cancel-in-progress: false
queue: max
runs-on: ubuntu-latest
environment: release
env:
Expand All @@ -67,11 +69,11 @@ jobs:
create_draft="false"
manual_target_sha_supplied="false"
if [[ "$EVENT_NAME" == "pull_request_target" ]]; then
if [[ ! "$PR_HEAD_REF" =~ ^(release/)?v((0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*))$ ]]; then
echo "Release branch must match vX.Y.Z or release/vX.Y.Z" >&2
if [[ ! "$PR_HEAD_REF" =~ ^release/v((0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*))$ ]]; then
echo "Release branch must match release/vX.Y.Z" >&2
exit 1
fi
version="${BASH_REMATCH[2]}"
version="${BASH_REMATCH[1]}"
target_sha="$PR_MERGE_SHA"
preflight_level="full"
create_draft="true"
Expand Down
30 changes: 19 additions & 11 deletions tests/release-workflow.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,7 @@ describe("GitHub Draft Release v2 workflow", () => {
}
});

it("creates Draft Releases from merged vX.Y.Z PRs and keeps manual fallback", () => {
it("creates Draft Releases only from merged release/vX.Y.Z PRs and keeps manual fallback", () => {
expect(draftWorkflow.on.pull_request_target).toEqual({
types: ["closed"],
branches: ["main"],
Expand All @@ -247,17 +247,22 @@ describe("GitHub Draft Release v2 workflow", () => {
"full",
]);
expect(draftWorkflow.on.workflow_dispatch.inputs.create_draft.default).toBe(false);
expect(draftJob.if).toContain("github.event.pull_request.merged == true");
expect(draftJob.if).toContain("startsWith(github.event.pull_request.head.ref, 'v')");
expect(draftJob.if).toContain("startsWith(github.event.pull_request.head.ref, 'release/v')");
const normalizedJobCondition = String(draftJob.if).replace(/\s+/g, " ").trim();
expect(normalizedJobCondition).toBe(
"github.event_name == 'workflow_dispatch' || " +
"(github.event.pull_request.merged == true && " +
"github.event.pull_request.head.repo.full_name == github.repository && " +
"startsWith(github.event.pull_request.head.ref, 'release/v'))",
);

const resolve = draftScript("Resolve and validate release");
expect(resolve).toContain('if [[ "$EVENT_NAME" == "pull_request_target" ]]');
expect(resolve).toContain(
"^(release/)?v((0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$",
"^release/v((0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$",
);
expect(resolve).toContain("vX.Y.Z or release/vX.Y.Z");
expect(resolve).toContain('version="${BASH_REMATCH[2]}"');
expect(resolve).toContain("Release branch must match release/vX.Y.Z");
expect(resolve).not.toContain("vX.Y.Z or release/vX.Y.Z");
expect(resolve).toContain('version="${BASH_REMATCH[1]}"');
expect(resolve).toContain('target_sha="$PR_MERGE_SHA"');
expect(resolve).toContain('preflight_level="full"');
expect(resolve).toContain('create_draft="true"');
Expand Down Expand Up @@ -497,15 +502,18 @@ describe("GitHub Draft Release v2 workflow", () => {
expect(create).toContain("trap - EXIT");
});

it("uses the release environment, minimal permissions, and per-version concurrency", () => {
it("uses the release environment, minimal permissions, and global non-cancelling concurrency", () => {
expect(draftWorkflow.permissions).toEqual({
contents: "write",
"pull-requests": "read",
});
expect(draftJob.environment).toBe("release");
expect(draftWorkflow.concurrency["cancel-in-progress"]).toBe(false);
expect(draftWorkflow.concurrency.group).toContain("inputs.version");
expect(draftWorkflow.concurrency.group).toContain("pull_request.head.ref");
expect(draftWorkflow.concurrency).toBeUndefined();
expect(draftJob.concurrency).toEqual({
group: "draft-release-v2",
"cancel-in-progress": false,
queue: "max",
});
});

it("records the manual Publish boundary in the workflow summary", () => {
Expand Down