ci: release on a seven-day cadence

[jdx]

https://entire.io/gh/jdx/demand/trails/23

Summary

Releases are currently cut whenever the release PR gets merged by hand. This adds the same auto-merge-release workflow that hk, tak, usage and fnox already use, so a release happens on a cadence instead:

• runs daily at 10:00 UTC (and on manual dispatch, which skips the guards)
• merges the open release PR only if the latest v* tag is at least 7 days old
• and only if there is a pending fix/feat commit since that tag
• skips a release PR with an empty body (release-plz still writing it) and retries the next day
• uses gh pr merge --squash --auto, so required checks still gate the merge

Merging the release PR is still what triggers the existing release job; nothing else changes.

Test plan

• Not run locally; the workflow is copied from the existing repos with only the repo slug, token secret and release-PR branch matcher changed.
• After merge, trigger it with workflow_dispatch to confirm it finds the release PR.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.288.

🤖 Generated with Claude Code

---

Note

Medium Risk
Automates production releases via token-backed PR merge; mitigated by cadence guards, release-plz PR matching, and --auto waiting on CI.

Overview
Adds a scheduled GitHub Actions workflow auto-merge-release so releases run on a cadence instead of only when someone merges the release-plz PR by hand.

The job runs daily at 10:00 UTC (and on workflow_dispatch, which bypasses cadence checks). On schedule it only proceeds if the latest v* tag is at least seven days old and there is at least one fix/feat commit since that tag; it then finds the open release-plz release PR to main (branch prefix, title, and same-repo head checks) and merges it with gh pr merge --squash --auto so existing required checks still apply. Empty PR bodies are skipped until the next run. Merging that PR remains the sole trigger for the existing release-plz release job.

^{Reviewed by Cursor Bugbot for commit a8da648. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Release pull requests that meet the required criteria can now be merged automatically using squash merging.
  • Automatic checks run daily and can also be started manually. Scheduled runs observe release timing and pending-change checks; manual runs bypass those checks.
  • The workflow skips merging when no eligible release pull request is available or its description is blank.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: ec66e997-21f4-4448-8d23-4a160bcf6843

📥 Commits

Reviewing files that changed from the base of the PR and between e5cedc2 and a8da648.

📒 Files selected for processing (1)

• .github/workflows/auto-merge-release.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a scheduled and manually triggered workflow that checks release cadence, selects an eligible release PR, and enables squash auto-merge when the PR body is not empty.

Changes

Release PR auto-merge

Layer / File(s)	Summary
Workflow triggers and repository setup .github/workflows/auto-merge-release.yml	Defines daily and manual triggers, run concurrency, a repository guard, permissions, and checkout settings.
Scheduled release cadence checks .github/workflows/auto-merge-release.yml	Scheduled runs stop when a matching tag is less than seven days old or when no matching fix or feature commit subject is pending. Manual runs skip these checks. A missing tag permits a bootstrap run.
Release PR selection and merge .github/workflows/auto-merge-release.yml	Selects the most recently updated eligible open PR to main. Skips when there is no match or the PR body is empty after whitespace removal. Otherwise, enables squash auto-merge.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant RepositoryHistory
  participant ReleasePR
  GitHubActions->>RepositoryHistory: Check release tags and commit subjects
  GitHubActions->>ReleasePR: Select the most recently updated matching open PR
  GitHubActions->>ReleasePR: Check PR body for non-whitespace text
  GitHubActions->>ReleasePR: Enable squash auto-merge

Loading

Merge Risk: ⚪ Minimal · up to a8da6

This adds a scheduled workflow that enables auto-merge on the release PR. No concrete merge-blocking risk was found. The author notes it was not tested locally, so run it with workflow_dispatch after merge as planned.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the workflow’s seven-day release cadence. It does not mention the automatic merge, but it identifies the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds automated release workflow that merges and publishes code.

The PR appears safe to merge.

What we checked:

• Release still runs after merging: The merge uses RELEASE_PLZ_TOKEN, not the job's read-only token. The existing release workflow runs on pushes to main.

Summary

Adds a daily workflow that enables automatic squash merging for release PRs after seven days, when pending fix or feat commits exist.

• Manual runs bypass the age and commit guards.
• Empty release PR bodies delay merging until a later run.
• The existing release workflow still publishes after a push to main.
• No actionable issues were found.
• The fix/feat-only gate follows jdx's stated release policy; other commit types are intentionally excluded.

_{Reviews (1) · Last reviewed commit: "ci: release on a seven-day cadence"}