Skip to content

chore(release): unify release automation as Oli bot #252

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
f0rr0 merged 4 commits into from
Oct 5, 2026
Merged

chore(release): unify release automation as Oli bot #252

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae6975f
refactor(release): consolidate automation under Oli bot
f0rr0 Oct 5, 2026
88e0aec
fix(release): preserve bootstrap draft visibility with Oli
f0rr0 Oct 5, 2026
ffcfc34
docs(release): use Oli Release Bot app name
f0rr0 Oct 5, 2026
6f11cf5
fix(release): link commits to renamed Oli bot account
f0rr0 Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
134 changes: 97 additions & 37 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,9 +78,9 @@ jobs:
if: ${{ inputs.operation == 'prepare-release-pr' }}
environment: release-pr
permissions:
contents: write
issues: write
pull-requests: write
contents: read
issues: read
pull-requests: read
steps:
- name: Require main
run: |
Expand All @@ -97,15 +97,17 @@ jobs:
id: require_current_main
timeout-minutes: 1
run: bash .github/scripts/require-current-main.sh "$GITHUB_SHA"
- name: Require release PR token
env:
RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }}
run: |
if [[ -z "${RELEASE_PR_TOKEN}" ]]; then
echo "RELEASE_PR_TOKEN is required so generated release PRs trigger normal PR CI." >&2
echo "Configure a GitHub App or maintainer bot token in the release-pr environment." >&2
exit 1
fi
- name: Create Oli release PR token
id: release_pr_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: write
permission-issues: write
permission-pull-requests: write
- name: Set up Moon
uses: ./.github/actions/setup-moon
with:
Expand All @@ -114,7 +116,7 @@ jobs:
- name: Generate the Release Please candidate locally
id: prepare_candidate
env:
GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }}
GH_TOKEN: ${{ steps.release_pr_token.outputs.token }}
run: bash tools/release/prepare-release-pr.sh "$RUNNER_TEMP/release-candidate"
- name: Set up Rust for release manifest synchronization
if: ${{ steps.prepare_candidate.outputs.required == 'true' }}
Expand All @@ -125,7 +127,7 @@ jobs:
- name: Publish the completed release PR tree
if: ${{ steps.prepare_candidate.outputs.required == 'true' }}
env:
GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }}
GH_TOKEN: ${{ steps.release_pr_token.outputs.token }}
run: bash .github/scripts/publish-release-pr.sh "$RUNNER_TEMP/release-candidate"
- name: Report no release changes
if: ${{ steps.prepare_candidate.outputs.required != 'true' }}
Expand Down Expand Up @@ -885,7 +887,7 @@ jobs:
environment: release-bootstrap
permissions:
actions: read
contents: write
contents: read
id-token: write
pull-requests: read
steps:
Expand Down Expand Up @@ -937,9 +939,18 @@ jobs:
uses: ./.github/actions/setup-npm-publisher
with:
npm-version: ${{ env.NPM_VERSION }}
- name: Create Oli bootstrap preflight token
id: bootstrap_preflight_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: write
- name: Preflight selected product tag and release collisions
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.bootstrap_preflight_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: |
bash tools/release/verify-product-tags.sh \
Expand Down Expand Up @@ -1187,11 +1198,9 @@ jobs:
promoted: ${{ steps.promote_github_releases.outcome == 'success' }}
permissions:
actions: read
artifact-metadata: write
attestations: write
contents: write
contents: read
id-token: write
pull-requests: write
pull-requests: read
steps:
- name: Record release deadline
id: release_job_deadline
Expand Down Expand Up @@ -1237,19 +1246,33 @@ jobs:
env:
RELEASE_OPERATION: publish
run: bun .github/scripts/verify-github-oidc-identity.mts
- name: Check Oli release App permissions
id: check_release_tag_app
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: write
permission-workflows: write
permission-issues: write
permission-pull-requests: write
permission-attestations: write
permission-actions: read
- name: Prove Release Please PR can complete after publication
id: assert_release_please_markable
timeout-minutes: 1
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
run: |
tools/dev/bun.sh tools/release/release-please-pr-lifecycle.mts \
assert-markable \
--release-sha "${{ fromJSON(needs.plan-candidate.outputs.verify_publication_candidate).release_sha }}" \
--base main
- name: Preflight selected product tag and release collisions
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: |
gh auth setup-git
Expand All @@ -1260,14 +1283,10 @@ jobs:
bun .github/scripts/manage-release-drafts.mts preflight \
--products-json "$PRODUCTS_JSON" \
--head-ref "$RELEASE_HEAD_SHA"
- name: Check release tag App permissions
id: check_release_tag_app
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with: *release_tag_app
- name: Check publish environment
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
GITHUB_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
Expand Down Expand Up @@ -1316,8 +1335,8 @@ jobs:
- name: Validate product versions and registry state
id: validate_release_registry_state
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
GITHUB_TOKEN: ${{ steps.check_release_tag_app.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: |
bash tools/release/release-check-registries.sh \
Expand Down Expand Up @@ -1423,14 +1442,14 @@ jobs:
id: verify_product_tags
timeout-minutes: 5
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.release_tag_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: bash tools/release/verify-product-tags.sh --products-json "${PRODUCTS_JSON}" --target "$RELEASE_HEAD_SHA"
- name: Verify exact-SHA GitHub release staging
id: verify_github_staging
timeout-minutes: 5
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.release_tag_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: bun .github/scripts/manage-release-drafts.mts verify --products-json "$PRODUCTS_JSON" --head-ref "$RELEASE_HEAD_SHA" --state staged
- name: Publish all selected GitHub release asset sets concurrently
Expand All @@ -1439,6 +1458,9 @@ jobs:
env:
GITHUB_RELEASE_ASSET_UPLOAD_REPORT_PATH: ${{ runner.temp }}/oliphaunt-github-release-asset-upload-report.json
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_TAG_APP_CLIENT_ID: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
RELEASE_TAG_APP_PRIVATE_KEY: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
RELEASE_APP_INSTALLATION_ID: ${{ steps.check_release_tag_app.outputs.installation-id }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: bash tools/release/with-source.sh "$RELEASE_HEAD_SHA" bash tools/dev/bun.sh tools/release/release-publish.mts publish --step github-release-assets --products-json "${PRODUCTS_JSON}" --head-ref "$RELEASE_HEAD_SHA" --publication-lock "$PUBLICATION_LOCK_PATH"
- name: Resolve frozen release provenance subjects
Expand All @@ -1455,13 +1477,25 @@ jobs:
run: |
tools/dev/bun.sh tools/release/github-content-write-pacer.mts reserve --label "release asset provenance"
tools/dev/bun.sh tools/release/github-core-request-journal.mts reserve --label "release asset provenance API attempt"
- name: Create Oli attestation token
id: release_attestation_token
if: ${{ steps.release_provenance_subjects.outputs.has_subjects == 'true' }}
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: read
permission-attestations: write
- name: Attest frozen release assets
id: release_provenance
if: ${{ steps.release_provenance_subjects.outputs.has_subjects == 'true' }}
timeout-minutes: 5
uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661
with:
subject-path: ${{ steps.release_provenance_subjects.outputs.subject_paths }}
github-token: ${{ steps.release_attestation_token.outputs.token }}
- name: Create fresh SwiftPM tag token
id: swift_tag_token
if: ${{ contains(fromJson(fromJSON(needs.plan-candidate.outputs.release_plan).products_json), 'oliphaunt-swift') }}
Expand All @@ -1474,12 +1508,23 @@ jobs:
env:
GH_TOKEN: ${{ steps.swift_tag_token.outputs.token }}
run: bash tools/release/publish-swiftpm-source-tag.sh --push --target "$RELEASE_HEAD_SHA" --publication-lock "$PUBLICATION_LOCK_PATH"
- name: Create fresh Oli verification token
id: release_evidence_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with: &release_evidence_app
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: write
permission-actions: read
permission-attestations: read
- name: Freeze exact GitHub release asset and attestation evidence
id: freeze_github_evidence
timeout-minutes: 10
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.release_evidence_token.outputs.token }}
GITHUB_TOKEN: ${{ steps.release_evidence_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
RELEASE_PROVENANCE_BUNDLE: ${{ steps.release_provenance.outputs.bundle-path }}
run: |
Expand Down Expand Up @@ -1521,12 +1566,16 @@ jobs:
--products-json "$PRODUCTS_JSON" \
--head-ref "$RELEASE_HEAD_SHA" \
--publication-lock "$PUBLICATION_LOCK_PATH"
- name: Create fresh Oli verification token
id: release_verify_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with: *release_evidence_app
- name: Verify published release
id: verify_published_release
timeout-minutes: 8
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.release_verify_token.outputs.token }}
GITHUB_TOKEN: ${{ steps.release_verify_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: |
gh auth setup-git
Expand Down Expand Up @@ -1585,11 +1634,22 @@ jobs:
include-hidden-files: true
overwrite: true
retention-days: 90
- name: Create Oli release promotion token
id: release_promotion_token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
owner: f0rr0
repositories: oliphaunt
permission-contents: write
permission-issues: write
permission-pull-requests: write
- name: Promote verified GitHub release drafts
id: promote_github_releases
timeout-minutes: 16
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ steps.release_promotion_token.outputs.token }}
PRODUCTS_JSON: ${{ fromJSON(needs.plan-candidate.outputs.release_plan).products_json }}
run: |
tools/dev/bun.sh tools/release/release-please-pr-lifecycle.mts \
Expand Down
Loading