Skip to content

Read the release version from a VERSION file (1.2.0) - #15

Closed
pjhartlieb wants to merge 2 commits into
blacklanternsecurity:devfrom
pjhartlieb:feat/version-file
Closed

pjhartlieb wants to merge 2 commits into
blacklanternsecurity:devfrom
pjhartlieb:feat/version-file

Conversation

@pjhartlieb

Copy link
Copy Markdown
Contributor

release-check and stable-guard read the release version only from the package manifest (pyproject.toml, or through it Cargo.toml). A Go or Docker-only repository has neither, so it can't release through these workflows. bbot-io-developer-portal is the first. Its version now lives only in its publish job's image tags.

manifest.py now falls back to a VERSION file at the repository root when there is no manifest version:

  • A repository with only VERSION: that is the release version, under the same MAJOR.MINOR.PATCH, chart and git-dependency checks.
  • Both present: they must agree, or the release stops, as a chart version that disagrees with the manifest already does.
  • Neither: the error now names the missing source.

Nothing changes for existing callers, which all have a manifest version, so this is a minor version: 1.2.0.

Tests: five new cases (VERSION only, a prerelease in VERSION, a mismatch, a match, neither). 46 pass. Against the old manifest.py, four of the five new tests fail; the fifth guards that a matching VERSION file changes nothing. ruff clean; zizmor 1.30.1 (online audits) and actionlint 1.7.12 report nothing.

…a package manifest

release-check and stable-guard read the version only from pyproject.toml (or through it) or Cargo.toml, so a Go or Docker-only repository (bbot-io-developer-portal) had no way to release. A root VERSION file now supplies it when there is no manifest version. Where both exist they must agree, as chart versions must, so the file cannot drift. Tests cover a VERSION-only repository, a prerelease in VERSION, a mismatch, a match, and the error that names the missing source.
Minor: a VERSION file is a new way to declare the release version; nothing changes for existing callers.
@pjhartlieb
pjhartlieb requested a review from a team as a code owner November 9, 2026 20:59
@pjhartlieb

Copy link
Copy Markdown
Contributor Author

Replaced by #16, the same two commits from a branch in this repository: CodeQL default setup does not scan pull requests from forks, and dev requires code scanning.

@pjhartlieb pjhartlieb closed this Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant