Repository navigation
chore: follow upstream with bump branches instead of next - #133
Open
Gkrumbach07 wants to merge 2 commits into
Open
Gkrumbach07 wants to merge 2 commits into
Gkrumbach07 wants to merge 2 commits into
Conversation
Since the move to the ai-openshell org, the `next` machinery no longer works: nobody is an admin, main's ruleset resets approval on every push (and `next` was force-pushed hourly), and the enterprise refuses the long-lived UPSTREAM_BOT_TOKEN. - Follow upstream runs once a day. For a new stable OpenShell release it creates bump/openshell-X.Y.Z from main with one signed-off pin-move commit, starts CI on it with workflow_dispatch (a PR opened with the default token starts none) and opens a PR into main. It makes a bump branch once and never rebases, moves or force-pushes it. - A person can run it with a `version` to make a prep branch for a pre-release. Check A still runs nightly against upstream's newest pre-release and keeps the compat-migrate issue, which now says how to start a prep branch. - publish.yml is manual only: no release after a merge, and next-merge.mjs is gone. Release branches are made by hand. - ci.yml no longer runs for `next`, can be started by hand (publishing nothing), and `pins a stable release` applies to every PR. - The pin move accepts the SDK's own tag (upstream tags sdk/go/v0.1.7), checked with `go list -m -json` to be the release commit. Found by a dry run against 0.1.7, which every bump from now on would have hit. - Only the default token is used; UPSTREAM_BOT_TOKEN and UPSTREAM_AUTOMERGE can be deleted. - ADR 0005 gets a dated amendment; the upstream README, releasing, contributing, rules and skills docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
Simon (infra) keeps "Allow GitHub Actions to create and approve pull requests" off org-wide, and a pull request opened with the default token runs no CI. So the bump job now takes a token from the organization's bump-bot GitHub App, the same setup as sdk-go: - The job runs in the `bump-bot` environment, which only main can deploy to, and gets its token with actions/create-github-app-token from BUMP_BOT_CLIENT_ID and BUMP_BOT_PRIVATE_KEY, asked for with contents and pull requests write only. Its own GITHUB_TOKEN is read-only. - The App token reaches only the steps that list pull requests and publish, as the default token did. - No more starting CI by hand: ci.yml drops workflow_dispatch and the check-* changes that went with it, and publish.py drops the dispatch. - Every action in follow-upstream.yml is pinned by commit SHA; a test holds it to that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
This was referenced Nov 6, 2026
danreed-rh
reviewed
Nov 6, 2026
| if: needs.plan.outputs.bump == 'true' | ||
| runs-on: ubuntu-latest | ||
| # The App's secrets are in this environment, and only main may use it. | ||
| environment: bump-bot |
Contributor
There was a problem hiding this comment.
Manual runs from refs other than main are marked as dry runs at line 100, but a ready target still starts this job and requires the bump-bot environment. The PR says this environment is restricted to main, so these runs cannot access the App secrets or produce the promised bump preview. Could the preview run outside the protected environment, with only publishing guarded to main?
| `none` means the move changed nothing: main already pins the target. | ||
| """ | ||
| git = Git(repo) | ||
| main = git.out("rev-parse", "--verify", "%s^{commit}" % main_ref) |
Contributor
There was a problem hiding this comment.
This uses the workflow run’s checked-out HEAD as its base, which may no longer match current main when the branch is pushed. If the pin on main advances past the planned target during the run, the stale bump can still be published; the stable-release check does not reject backward pin changes, and the workflow will not refresh this branch later. Could it re-check the latest main pin before publishing and reject non-forward pin changes?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Since the move to
ai-openshell, thenextsetup can't work:main's ruleset asks for a code owner's approval after the last push and dismisses stale ones.nextwas force-pushed every hour, so its approval never survived.UPSTREAM_BOT_TOKENis rejected and Follow upstream has failed every hour since the move.nextmerge both depended on the above.What changes
Follow upstream (
.github/workflows/follow-upstream.yml,deploy/ci/upstream/)bump/openshell-X.Y.Zfrommainwith one signed-off commit (pins,go.mod/go.sum, release line, README block) and opens a PR intomain.version(for example0.2.0-pre.1) makes a prep branch for a pre-release. Its PR failspins a stable releaseuntil upstream ships.compat-migrateissue, which now says how to start a prep branch.sdk-go. The job runs in abump-botenvironment that onlymaincan use, gets its token fromBUMP_BOT_CLIENT_IDandBUMP_BOT_PRIVATE_KEYwith contents and pull-requests write only, and hands it to just the two steps that list PRs and publish. Because the App opens the PR, CI runs on it normally. Allow GitHub Actions to create and approve pull requests stays off.follow-upstream.ymlis pinned by commit SHA, and a test enforces it.nextbranch.pyis replaced by the much smallerbump.py, andpublish.pyis rewritten.CI (
ci.yml)nextin the PR triggers.pins a stable releasenow runs on every PR.Releases (
publish.yml,scripts/release/)workflow_runtrigger andnext-merge.mjsare gone. Merging a bump releases nothing.Tagged SDK (
pinmove.py)sdk/go/v0.1.7), sogo getof the release commit resolves tov0.1.7, not a pseudo-version. The pin move accepts the tag only aftergo list -m -jsonconfirms it points at the release commit.Docs: a dated amendment to ADR 0005, a rewrite of
deploy/ci/upstream/README.md, and updates todocs/releasing.md,CONTRIBUTING.md,AGENTS.md,.claude/rulesand skills.Testing
python3 -m unittest discover -s deploy/ci/upstream: 266 passnode --test "scripts/**/*.test.mjs": 88 passvalidate-pins,gateway-range.mjs --check, and a YAML parse of all workflowsmainpins 0.1.6). The bump step made one commit bygithub-actions[bot]that touches onlygateway-pins.json,go.mod,go.sumandREADME.md, and its pins passvalidate-pins.publish --dry-runprinted exactly the leased push andgh pr create. Nothing was pushed. (The dry run predates the switch to the App token; the commands are the same.)Not tested: a live run on GitHub. The first scheduled run after merge should open
bump/openshell-0.1.7.Before / after merging
bump-botenvironment limited tomainholdingBUMP_BOT_CLIENT_IDandBUMP_BOT_PRIVATE_KEY. If the names differ from these, tell me and I'll change them; they're in one place in the workflow. Until it exists, thebumpjob fails; plan, check A and the report still run.UPSTREAM_BOT_TOKENsecret and theUPSTREAM_AUTOMERGEvariable.ci.yml). Merge this one first, with Rebase and merge so the stacked PR stays clean.🤖 Generated with Claude Code