ci: switch release workflow to PR-based flow#114
Merged
Conversation
The previous release workflow pushed the version bump and CHANGELOG directly to main, which conflicts with the org ruleset requiring all main changes to go through pull requests (GH006). This splits the release into two workflows: - `release.yml` (manual dispatch): runs semantic-release in `--no-commit --no-push --no-tag --no-vcs-release` mode to update the version files and CHANGELOG in-workspace, then opens a labeled PR via `peter-evans/create-pull-request`. Re-dispatching updates the PR in place. - `release-finalize.yml` (pull_request:closed): when the labeled release PR merges into main, creates the git tag at the merge commit and publishes the GitHub Release with the extracted CHANGELOG section. Uses the same `peter-evans/create-pull-request` SHA pin (v8.1.1) that other netboxlabs repos standardize on. No GitHub App or PAT required — works with the default `GITHUB_TOKEN`. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
ltucker
approved these changes
Apr 20, 2026
Remove redundant steps and defaults surfaced in review: drop the has_changes pre-check (peter-evans handles empty diffs), swap uv sync for uvx to skip installing project deps, collapse tag + release into a single gh release create --target, and prune inherited boilerplate (default tokens, default uv version, redundant cancel-in-progress). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
abubnalitic-nbl
force-pushed
the
chore/release-pr-flow
branch
from
0f03dfb to
d489275
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This adopts a two-workflow PR-based flow that works within the protection rules, with no org-admin or PAT escalation required.
What changes
release.yml(manual dispatch, replaces existing file)semantic-release version --no-commit --no-push --no-tag --no-vcs-releaseto updatepyproject.toml,__init__.py, andCHANGELOG.mdin the workflow's workspace onlyrelease,automated) PR viapeter-evans/[email protected], pinned to SHA (5f6978f)release/next)release-finalize.yml(new, triggers on PR merge)releasemerges into mainv{version}and publishes a GitHub Release with the CHANGELOG section for that versionTest plan
Release PRworkflow → verify a PR for v1.1.0 opens with the expected file changesrelease-finalize.ymlruns, creates the tag, and publishes the GitHub Releasedocker-publish.ymlfires on the new tag as before (no changes needed there)🤖 Generated with Claude Code