feat(release): automate OSS release pipeline with just release#757
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
wpfleger96
force-pushed
the
wpfleger/release-automation
branch
from
6339a4f to
ea71fd2
Compare
Version files drifted between OSS (v0.0.21) and internal (v0.2.38). Unify at v0.3.0 and add a one-command release flow: `just release` creates a version-bump PR; merging it auto-tags and triggers the existing build/sign/publish pipeline via release.yml. Adds bump-version recipe covering all 4 manifests + 3 lockfiles, auto-tag workflow for version-bump/* PR merges, and tag-push trigger to release.yml (preserving workflow_dispatch as manual fallback).
Move ${{ }} interpolations in workflow run blocks to env blocks to
prevent shell injection via GitHub context variables. Also fix the
Internal Releases section to reference the Buildkite pipeline (not
GitHub Actions) since sprout-releases uses Buildkite.
…se.yml Pre-existing Semgrep alert #5 flags ${{ steps.version.outputs.version }} in run blocks. Move all 4 occurrences (validate, patch, generate latest.json, create release) to env blocks for consistency with the earlier fix for github.event_name and inputs.version.
Fixes 12 issues surfaced by parallel Claude, Codex, and Gemini review:
- auto-tag workflow: add workflow_dispatch to trigger release.yml
(GITHUB_TOKEN push events don't trigger downstream workflows, but
workflow_dispatch is explicitly exempted from this restriction)
- auto-tag workflow: add semver validation and route env.version
through env: block to prevent shell injection
- release-linux: move ${{ needs.release.outputs.version }} from run:
blocks to env: blocks (2 steps)
- release notes: extract changelog section instead of bare version
- justfile: replace broken BSD sed 0-address with node -e for
Cargo.toml version bump
- justfile: use cargo update -p instead of generate-lockfile to avoid
upgrading all transitive deps
- justfile: widen bump-version regex to accept pre-release suffixes
- justfile: add git fetch + origin/main divergence check
- justfile: filter git describe to v[0-9]* tags only
- justfile: replace git add -A with explicit file list
- justfile: prepend changelog entries (newest first)
- RELEASING.md: expand internal releases with pipeline URL, field
table, -block suffix note, and publish_latest explanation
wpfleger96
force-pushed
the
wpfleger/release-automation
branch
from
fe5e419 to
a7469ef
Compare
Point agents to RELEASING.md for release process context. Fix the sprout-releases Buildkite pipeline URL from cash to runway org.
Maps the five repos (block/sprout, sprout-releases, sprout-oss, block-coder-tf-stacks, sprout-backend-blox) with a table and flow diagram so agents understand the broader system context.
wesbillman
reviewed
May 27, 2026
Collaborator
wesbillman
left a comment
wesbillman
left a comment
There was a problem hiding this comment.
🤖 I left one release-flow safety comment. The core concern is retry/idempotency around tag creation and workflow dispatch.
If tag push succeeds but the subsequent workflow dispatch fails or times out, re-running the workflow would error on the existing tag and never dispatch the release build. Now checks for an existing tag first: skips creation if it matches the merge commit, fails loudly if it points elsewhere.
wesbillman
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a one-command release flow --
just release-- and wires up GitHub Actions to fully automate the build trigger, replacing the previous manualworkflow_dispatch-only approach. Also unifies the OSS and internal version atv0.3.0(above bothv0.0.21OSS andv0.2.38internal).The previous release process required manually navigating to GitHub Actions and filling in version/ref inputs every time. This follows the goose/goose-releases pattern: a local command creates the version-bump PR, merging it auto-tags, and the auto-tag workflow dispatches the release build via
workflow_dispatch(sinceGITHUB_TOKENpush events don't trigger downstream workflows, butworkflow_dispatchis explicitly exempted from this restriction).get-current-version,get-next-minor-version,get-next-patch-version,bump-version, andreleaserecipes tojustfile;bump-versionupdates all 4 manifests (desktop/package.json,tauri.conf.json,Cargo.toml,mobile/pubspec.yaml) and regenerates all 3 lockfiles.github/workflows/auto-tag-on-release-pr-merge.yml-- detectsversion-bump/*PR merges tomain, pushes thevX.Y.Ztag, then dispatchesrelease.ymlviagh workflow run; tag creation is idempotent so retries work correctly if the dispatch step fails after the tag push succeedsrelease.ymlto trigger onpush.tagsin addition toworkflow_dispatch; version is derived from the tag name when tag-triggered, from the input when manual; addsoutputs.versionon thereleasejob sorelease-linuxcan consume it; all${{ }}expressions inrun:blocks routed throughenv:blocks; release notes extracted fromCHANGELOG.md; build/sign/notarize logic is untouched0.3.0and regenerates lockfiles for the baseline alignmentRELEASING.mdto document the new flow, including Buildkite pipeline details for internal releases with-blocksuffix explanationRELEASING.mdreference and sprout ecosystem overview toAGENTS.mdCompanion PR: sprout-releases#14 -- adds
-blockversion suffix to internal desktop builds and fixes thepublish-updaterpipeline dependency.