diff --git a/.claude/skills/bump-version-release/SKILL.md b/.claude/skills/bump-version-release/SKILL.md index ceeb3283..ff641db4 100644 --- a/.claude/skills/bump-version-release/SKILL.md +++ b/.claude/skills/bump-version-release/SKILL.md @@ -13,11 +13,11 @@ Releases are made by the org release pipeline (megaeth-labs/.github). Merging it cuts `release-vX.Y.Z`. Fixes for the release go to that branch by PR, and every such fix must also land on `main` (cherry-pick it in a separate PR): the next candidate is cut from `main`, so a fix that exists only on the release branch is lost in the next release. 2. **Settle** — `gh workflow run release-settle.yml --ref main -f version=X.Y.Z -f commit=`. - This opens a PR onto the release branch with the finalised changelog entry. - Merging it is the release approval. -3. **Publish** — automatic on that merge. - It creates the annotated tag `vX.Y.Z` and the GitHub Release with the entry as notes. -4. **Targets** — automatic on the Release: `on-release.yml` publishes the four crates to crates.io and uploads `mega-evme` to the MegaETH artifact registry and the Release page. + The dispatch is the release approval: the run waits for the `release` environment's reviewer, and the action checks that the dispatcher is a repository admin. + The same job then commits the finalised changelog entry to the release branch, creates the annotated tag `vX.Y.Z`, and publishes the GitHub Release with the entry as notes. + There is no settle PR; `release-publish.yml` only serves the PR mode this repo no longer uses. + Fix changelog wording before dispatching: in the candidate PR while it is open, or by a PR onto the release branch after it merges. +3. **Targets** — automatic on the Release: `on-release.yml` publishes the four crates to crates.io and uploads `mega-evme` to the MegaETH artifact registry and the Release page. Rehearse it first on an existing tag, dispatching on that tag's ref: `gh workflow run on-release.yml --ref vX.Y.Z -f dry_run=true`. The tag being released is always the run's own ref; there is no separate tag input. The publish credentials live in the `publish` environment, whose deployment policy allows only `v*` tag refs. diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 4ab64b42..b5ad3e1d 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -8,6 +8,11 @@ name: Release Publish # # This file must exist on the release branch (it does, when the branch is cut # from a default branch that has it). +# +# Only settlement by PR reaches this workflow. release-settle.yml settles +# directly (`settle_mode: direct`, gated by the `release` environment) and +# publishes from its own job, so nothing here fires unless this repo goes +# back to PR mode; the job gate rejects any settle PR the app did not open. on: pull_request: diff --git a/.github/workflows/release-settle.yml b/.github/workflows/release-settle.yml index 6f13dcc3..8915dff5 100644 --- a/.github/workflows/release-settle.yml +++ b/.github/workflows/release-settle.yml @@ -1,10 +1,18 @@ name: Release Settle -# Propose settling a release candidate. Dispatch from any branch with the +# Settle a release candidate. Dispatch from the default branch with the # version and the full SHA of the release-branch tip; the shared action # verifies it, generates release notes from the commits since the previous -# tag, writes them to the changelog, and opens a settle PR onto the release -# branch. Merging that PR is the settlement decision (release-publish tags it). +# tag, commits them to the changelog on the release branch, and publishes: +# annotated tag at that commit, GitHub Release with the notes (on-release.yml +# then runs the publish targets). +# +# The dispatch is the settlement decision, gated twice: the `release` +# environment on the job (its required reviewers approve the run before it +# starts; its deployment branch policy allows only the default branch) and +# `settlers` in the action (the dispatching actor must be a repository +# admin). The app is a bypass actor on the release-branch and `v*` tag +# rulesets, which is what lets the settle commit and the tag land. on: workflow_dispatch: @@ -18,8 +26,8 @@ on: required: true type: string -# One settle per version: two dispatches for the same version would both -# force-push the same settle branch. Queue, never cancel. +# One settle per version: two dispatches for the same version would race on +# the release branch. Queue, never cancel. concurrency: group: ${{ github.workflow }}-${{ inputs.version }} cancel-in-progress: false @@ -30,6 +38,7 @@ permissions: jobs: settle: runs-on: ubuntu-latest + environment: release steps: - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 id: app-token @@ -50,3 +59,5 @@ jobs: version_file: Cargo.toml version_pattern: toml changelog_file: CHANGELOG.md + settle_mode: direct + settlers: admin diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c2b86b3..d9f67041 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,8 @@ # Changelog All notable changes to mega-evm are recorded here, newest first. -Entries are generated by the release flow from merged PR titles; edit an entry in its release candidate or settle PR if the wording needs work. +Entries are generated by the release flow from merged PR titles. +Fix wording in the release candidate PR while it is open, or, after it merges, by a PR onto the release branch before settlement is dispatched. ## v1.7.1 (unreleased)