From f9c23d04bf5dd7fef7a17a3d72e9ee27a807917d Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Fri, 13 Nov 2026 16:33:52 -0500 Subject: [PATCH] Version the shared Go release workflow by tag Dependabot only moves a commit-SHA pin to a newer tagged commit, and recognises the version from a '# vX.Y.Z' comment. Document tagging each workflow change and pinning callers that way. --- go-release/README.md | 11 ++++++++++- go-release/tests/test_go_release.py | 3 +++ templates/go/release.yml | 4 +++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/go-release/README.md b/go-release/README.md index be91b29..5f044d0 100644 --- a/go-release/README.md +++ b/go-release/README.md @@ -7,13 +7,22 @@ nowhere else. The standard it implements is `~/.claude/rules/go.md`, *Go release ## Using it Copy [`templates/go/release.yml`](../templates/go/release.yml) to the repository's -`.github/workflows/release.yml` and pin the `uses:` line to a commit of this repository. It runs on: +`.github/workflows/release.yml` and pin the `uses:` line to the commit of this repository's latest +`vX.Y.Z` tag, with the version as the comment: `go-release.yml@ # vX.Y.Z`. It runs on: - a pushed `vX.Y.Z` or `vX.Y.Z-pre` tag: `git push origin vX.Y.Z`; - a request naming a tag already on GitHub: `gh workflow run release.yml --repo OWNER/REPO -f tag=vX.Y.Z`. Push a version tag only for final code: tags are final, and a pushed tag publishes. +## Versions + +This repository tags each change to the shared workflow as a release (`v1.0.0` on 2026-11-13 is the +first), and tags are final: a fix gets the next version. A caller pins +the tag's commit with a `# vX.Y.Z` comment, which is the form Dependabot's github-actions updater +recognises: it opens a pull request moving the commit and the comment together when a new tag appears. +A pin to a bare commit, or a comment that names a pull request, is never updated by Dependabot. + ## Inputs | Input | Default | What it is | diff --git a/go-release/tests/test_go_release.py b/go-release/tests/test_go_release.py index 0005f9e..58cc19d 100644 --- a/go-release/tests/test_go_release.py +++ b/go-release/tests/test_go_release.py @@ -112,6 +112,9 @@ def test_it_runs_on_a_version_tag_or_on_request(self): def test_a_dispatch_names_the_tag(self): self.assertRegex(self.text, r"workflow_dispatch:\n inputs:\n tag:") + def test_it_says_how_to_pin_a_version(self): + self.assertRegex(self.text, r"# replace with @ # vX\.Y\.Z when copying") + def test_it_calls_the_shared_workflow(self): self.assertIn("uses: simtabi/.github/.github/workflows/go-release.yml@", self.text) for perm in ("contents: write", "id-token: write", "attestations: write"): diff --git a/templates/go/release.yml b/templates/go/release.yml index 272d285..36a7ad3 100644 --- a/templates/go/release.yml +++ b/templates/go/release.yml @@ -35,6 +35,8 @@ jobs: contents: write id-token: write attestations: write - uses: simtabi/.github/.github/workflows/go-release.yml@main # pin to a commit when copying + # Pin to the commit of the latest vX.Y.Z tag of simtabi/.github, with that version as the comment + # (`@ # vX.Y.Z`): Dependabot's github-actions updater then moves both together. + uses: simtabi/.github/.github/workflows/go-release.yml@main # replace with @ # vX.Y.Z when copying with: tag: ${{ inputs.tag || github.ref_name }}