Repository navigation
feat(release): align snapshot releases with CLI Next - #1521
Conversation
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Greptile SummaryThis PR replaces the mutable nightly release with immutable nightly and ad-hoc releases and consolidates stable and unstable publishing into a reusable workflow.
Confidence Score: 3/5The PR is not yet safe to merge because valid ad-hoc inputs can leave unpublished tags and artifact verification can execute the wrong architecture. The new release path pushes its immutable tag before discovering that a historical source ref lacks the unstable release configuration, while the publisher downloads both Linux architectures and selects one without pinning amd64. Files Needing Attention: .github/workflows/nightly-release.yaml, .github/workflows/release-publish.yaml Important Files Changed
Sequence DiagramsequenceDiagram
actor User as Schedule or Maintainer
participant Prepare as Prepare job
participant Tests as Release tests
participant Git as GitHub tags
participant Publish as Shared publisher
participant Release as GitHub release
User->>Prepare: Select main, branch, or SHA
Prepare->>Prepare: Resolve SHA and immutable tag
Prepare->>Tests: Test source SHA
Tests-->>Prepare: Tests pass
Prepare->>Git: Push immutable tag
Git->>Publish: Checkout tag
Publish->>Release: Build and publish artifacts
Publish->>Release: Download and verify Linux binary
Reviews (1): Last reviewed commit: "feat(release): align unstable releases w..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Aligns UDS CLIβs unstable (nightly/ad-hoc) release process with the CLI Next immutable tag model by introducing immutable unstable tag naming, reusing a shared publish workflow, and enabling release-path testing/publishing against arbitrary refs.
Changes:
- Adds an unstable GoReleaser config and a shared
release-publishreusable workflow for stable/unstable publishing. - Updates canonical/release test workflows to optionally checkout and test an explicit ref (branch/SHA).
- Refactors the nightly workflow into a multi-job pipeline that prepares tags, runs release tests on the source SHA, publishes, and prunes old nightlies.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tasks/todo.md | Tracks remaining follow-up tasks for the release-path changes. |
| .goreleaser.unstable.yaml | New GoReleaser config for unstable prerelease publishing with immutable tags and SBOMs. |
| .github/workflows/test.yaml | Adds ref input to allow reusable test workflow to run against a specified ref. |
| .github/workflows/test-release.yaml | Passes an optional ref through to canonical tests for release validation. |
| .github/workflows/release.yaml | Skips stable release jobs for unstable tag patterns and delegates publishing to the shared workflow. |
| .github/workflows/release-publish.yaml | New reusable workflow to publish releases via GoReleaser and verify published artifacts. |
| .github/workflows/nightly-release.yaml | Reworks nightly into βunstable releaseβ pipeline: prepare/tag/test/publish + nightly retention cleanup. |
π‘ Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60fd20dabf
βΉοΈ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
bradclawsie
left a comment
bradclawsie
left a comment
There was a problem hiding this comment.
let's give it a shot!
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
slaskawi
changed the title
There was a problem hiding this comment.
π‘ Changes recommended
The snapshot workflow currently tests main rather than the exact captured source SHA and also needs a guardrail to avoid leaving orphaned snapshot tags if publication fails.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 11/11 changed files
- Comments generated: 3
- Review effort level: Lite
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
βΉοΈ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with π while any review is running, comments if it has suggestions, and reacts with π once all reviews finish with no findings. |
Co-authored-by: slaskawi <8417158+slaskawi@users.noreply.github.com>
There was a problem hiding this comment.
π‘ Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df7f4f1b3a
βΉοΈ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with π.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
β¦i-265 Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com> # Conflicts: # .github/workflows/nightly-release.yaml
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
|
Is there a forked repo in play where we can see this working? The PR feels quite complicated at this point (mostly due to the nature of Github Actions, nothing on you as a dev) and it seems difficult to assert behavior by just reading code. |
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
Mostly looking good to me. 1 small non blocking nit comment, but Chance's comment should probably be addressed
|
this also might require a careful merge/rebase since we merged in the release-please pr |
β¦i-265 Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com> # Conflicts: # .github/workflows/release.yaml
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
|
We used the same workflow in UDS CLI Next; its published releases are available at https://github.com/defenseunicorns/uds-cli-next/releases. The full flow here creates an upstream tag and prerelease, so I wonβt dispatch it without maintainer approval. |
|
Merged current |
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Signed-off-by: Sebastian Εaskawiec <sebastian.laskawiec@defenseunicorns.com>
Description
Implements CLI-265 with unique snapshot releases built and tested only from
main.How it works
main.v<version>-snapshot+<UTC timestamp>-<8-char SHA>.latest.Safety boundaries
main; arbitrary branches and SHAs cannot reach release-test write permissions.-snapshot+tags.Related Issue
Relates to CLI-265
Type of change
Checklist before merging
Validation
.goreleaser.snapshot.yamlpassedmise exec -- goreleaser check --config .goreleaser.snapshot.yaml..goreleaser.yamlretains a pre-existing deprecatedbrewsproperty, so its GoReleaser check exits non-zero.git diff --checkpassed.