Repository navigation
chore: release-please - #487
Merged
Merged
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
gusfcarvalho
approved these changes
Oct 9, 2026
ccf-lisa
Bot
force-pushed
the
ra/w1-s2-t02-release-please
branch
from
October 9, 2026 14:15
d9a80c2 to
bb46ff4
Compare
This was referenced Oct 9, 2026
Merged
gusfcarvalho
approved these changes
Oct 9, 2026
gusfcarvalho
pushed a commit
that referenced
this pull request
Oct 9, 2026
Task: W1-S2-T01 Part 1 of 3 of the api onboarding stack ([CCF Release Automation Design](https://claude.ai/code/artifact/39df6ba0-8484-4b08-bfc4-962357843585)). Replaces the repo's CI with a caller of the shared `ci-go-service.yml` from compliance-framework/workflows, pinned at the v1.5.0 release commit (`899dbe5`). The status check to require from now on is `ci / required`. **Removes:** `.github/workflows/ci.yml` (the old `CI` workflow). It is replaced in place by the new `ci.yml` caller. No other workflow called it. ## What the new caller sets - `prepare-command: make swag`, so the Swagger docs are regenerated before vet, the tests and the make targets, as the old unit and integration jobs did. - `make-targets: test-integration check-diff`. - `lint-timeout-minutes: 30` (the old lint job ran with `--timeout=30m`). - Triggers: `pull_request` types `[opened, edited, synchronize, reopened, labeled, unlabeled, closed]` and pushes to `main`, as on mock-api. - A `notify` job calling `notify-failure.yml` with `secrets: inherit`. ## Test race fix The stack also fixes a pre-existing test race that the new `-race` flag surfaced: in `internal/service/scheduler/scheduler_test.go`, `mockJob.Execute` wrote its `executed` and `execCount` fields from overlapping cron goroutines while the test read them (`TestCronScheduler_StartStop` failed on #487). The fields are now `atomic.Bool` and `atomic.Int32`, read with `Load()`; no non-test code changes. Locally, `go test -race -count=20 ./internal/service/scheduler/...` passes with the fix and reported the race in 1 of 20 runs without it. A sweep of the other test doubles found none mutated from goroutines the code under test starts. ## Old jobs and where they run now | Old job (check name) | Old command | New check | Notes | | --- | --- | --- | --- | | `lint` | golangci-lint v2.11.4, `--timeout=30m`, default linters | `ci / golangci-lint` | Same golangci-lint version. Reports only issues the change adds (new-from-merge-base). api has no `.golangci.yml`, so the shared base config applies. | | `unit-tests` | `make swag` then `make test` | `ci / go` | `go test -race ./...` (the race detector is new), plus gofmt, `go vet`, a `go mod tidy` check and `go build`. | | `integration-tests` | `make swag` then `make test-integration` | `ci / make` | Same make target. The tests start `postgres:17.5` through testcontainers; the old job had no workflow services, and the new runner (ubuntu-latest) has Docker too. The old job took about 8 minutes; the make job's timeout is 30. | | `check-diff` | `make check-diff` (PRs only) | `ci / make` | Same make target. It now also runs on pushes to `main`, where the old job was skipped. | | (none) | | `ci / common` | New: PR title check, vulnerability scan and actionlint. | Trigger change: the old workflow also ran on pushes to `release-*` branches. None exist, and from T02 on, releases are cut from `main` by release-please, so the new caller runs on `main` only. ## Legacy required checks The `main` ruleset requires `integration-tests`, `unit-tests` and `check-diff`, and the classic branch protection requires `unit-tests`. None of these run after this PR, so they stay pending here. A human removes the ruleset and the classic protection before the stack merges (W1-S2-PRE); this PR does not touch them. ## Verified - The caller's inputs match `ci-go-service.yml` at v1.5.0 (`prepare-command`, `make-targets`, `lint-timeout-minutes`). - `.gitignore` covers `cover.out`, which `make test-integration` writes before `check-diff` checks the tree. - No other workflow references the old `ci.yml`. - `ci / required` on this PR's head is the check to read. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ccf-lisa[bot] <286799724+ccf-lisa[bot]@users.noreply.github.com>
gusfcarvalho
pushed a commit
that referenced
this pull request
Oct 9, 2026
Task: W1-S2-T03 Part 3 of 3 of the api onboarding stack ([CCF Release Automation Design](https://claude.ai/code/artifact/39df6ba0-8484-4b08-bfc4-962357843585)). Stacked on #487. Moves the image publishing to the shared release workflows, pinned at the v1.5.0 release commit (`899dbe5`). **Removes:** `.github/workflows/publish.yml`. No other workflow called it. ## Changes - `release.yml`: calls `release-go-image.yml` on `release: published` and publishes `ghcr.io/compliance-framework/api` (one image: `Dockerfile`, context `.`). - `preview.yml`: calls `preview.yml` with kind `image` and `on-main: true`. The concurrency group is keyed by PR number, as on mock-api. - `cut-prerelease.yml`: `workflow_dispatch` caller of `cut-prerelease.yml`, which tags the next rc of the version the open release-please PR proposes. - `Dockerfile` (production stage only): declares `ARG VERSION=dev` and restores the OCI labels the old metadata-action step added (details below). - `AGENTS.md`: the release paragraph described the removed publish workflow; it now describes release-please, `release.yml`, `preview.yml` and `cut-prerelease`. ## Published artifacts: old vs new | | Old (`publish.yml`) | New (`release.yml` + `preview.yml`) | | --- | --- | --- | | Image | `ghcr.io/compliance-framework/api` | same | | Dockerfile and stage | `Dockerfile`, last stage (`production`) | same | | Platforms | `linux/amd64`, `linux/arm64` (QEMU on one runner) | same, built on native amd64 and arm64 runners and merged into one manifest list | | Provenance attestation | yes (build-push-action default) | yes | | Final release `vX.Y.Z` | `X.Y.Z`, `X.Y`, `X`, `latest`, `sha-<7>` | `X.Y.Z`, `X.Y`, `X`, `latest` | | Release candidate `vX.Y.Z-rcN` | `X.Y.Z-rcN`, `sha-<7>` | `X.Y.Z-rcN` | | Push to `main` | `main`, `latest`, `sha-<7>` | `main`, `sha-<7>` (`latest` no longer moves) | | Push to `seed` | `seed`, `sha-<7>` | nothing (trigger removed) | | PR | nothing | `pr-<number>` when the PR has the `preview` label | | Build args | none | `VERSION=<version>` only (`X.Y.Z`, `X.Y.Z-rcN`, `main-<sha7>`, `pr-<n>-<sha7>`) | | OCI labels | metadata-action: title, description, url, source, version, created, revision, licenses | workflow: source, revision; Dockerfile: title, description, url, licenses, version. `created` is no longer set | Notes: - The old final-release `sha-<7>` tag pointed at the tag build of the release commit. That commit is on `main`, so the new main preview still publishes a `sha-<7>` for it, from the main build. - On GHCR today, `0`, `0.21`, `0.21.0` and `latest` share one digest, so the floating `X` tag the new flow keeps was already published. - The old flow passed no build args. The Dockerfile had no `ARG VERSION`, so without the change above the new `VERSION` arg would be ignored (with a build warning). It is now used only for the `org.opencontainers.image.version` label. The binary is built exactly as before. ## Open questions for reviewers - The old publish workflow also ran on pushes to a `seed` branch. That branch no longer exists, and GHCR has no `seed` tag. Is a `seed` image still needed? This PR drops the trigger. ## Before and after merging (human) - The release and cut-prerelease jobs mint ccf-release-bot tokens from the repo's `release` environment, which repo-settings creates (W1-S2-PRE, per-repo order). - From the repo-settings apply on, rcs come only from `cut-prerelease`; nobody pushes `v*` tags by hand. ## Verified - Every new caller is pinned at `899dbe5` (v1.5.0), has a top-level `permissions` block and grants `packages: write` only to the publishing job. - Tag rules checked against `internal/release` (`ReleaseTags`, `PreviewTags`) at v1.5.0. - Current GHCR tags and the `0.21.0` image config (platforms, labels, entrypoint) checked against the table above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ccf-lisa[bot] <286799724+ccf-lisa[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task: W1-S2-T02
Part 2 of 3 of the api onboarding stack (CCF Release Automation Design). Stacked on #486.
Adds release-please, run as ccf-release-bot by the shared
release-please.yml(pinned at the v1.5.0 release commit,899dbe5).Removes: no workflow files. The old tag-push
publish.ymlis replaced in the next PR of the stack.Changes
release-please-config.json: the sharedrelease-please/defaults.jsonfrom workflows v1.5.0, copied verbatim (the shared workflow warns on drift), plusbootstrap-shaand one package.with release typego..release-please-manifest.json: seeded at0.21.0, the latest release.bootstrap-shais0b0cefc(currentmain, which is also thev0.21.0tag)..github/workflows/release-please.yml: runs on pushes tomain,secrets: inherit(the ccf-release-bot secrets come from the repo'sreleaseenvironment once repo-settings applies).ci.yml: adds therelease-checksjob (checks release PRs only; skipped, so passing, on any other PR) and adds it tonotify.Expected next version
v0.21.0is the currentmaincommit, so nothing has landed since the last release. After this stack merges, release-please sees only the onboarding commits (all of hidden types), so it opens no release PR yet. The first feature commit after that proposes0.22.0(a breaking change also gives0.22.0, sincebump-minor-pre-majoris on), and the first fix proposes0.21.1.None of this stack's PR bodies has a line that reads as a conventional commit, so the squash merges add no extra commits for release-please to count.
Before this merges (human)
release-please's first run on
mainneeds thereleaseenvironment secrets, so the repo-settings apply for api must come before this PR merges (W1-S2-PRE, per-repo order).Verified
go.modhas no compliance-framework dependencies, sorelease-checkshas no final-dependency check to fail on a release PR.🤖 Generated with Claude Code