Artifact [080fc7dc95]

Artifact 080fc7dc95ff988e173c639ca21830088505d77aef0a5a2344573e8e2d6490ed:

• File .github/workflows/auto-release.yml — part of check-in [8414300b13] at 2026-05-04 23:30:41 on branch trunk — chore: add auto-release workflow + scripts/release.sh (#141)

  Mechanizes the multi-step release flow that today is hand-driven via: 1. tag leaf submodule, push 2. open chore/bump-leaf PR, merge 3. tag root, push (fires release.yml + bones dispatch)

  scripts/release.sh detects which submodules have changes since their last <name>/v* tag, computes next versions (patch by default; --bump= minor|major), tags and pushes them, rewrites the matching require pin in root go.mod, commits straight to main as github-actions[bot], then tags the next root v* and pushes — firing release.yml.

  Local invocation prompts before each push so the operator can intervene. Workflow invocation (auto-release.yml) passes --ci to suppress prompts and uses the bot identity. --dry-run reports the plan without touching anything.

  Direct-to-main bot commits is the right tradeoff here: the change is deterministic robot work (one-line go.mod edit derived from the just- tagged version) and avoiding a PR round-trip lets a release ship in a single workflow run rather than coordinating across two. If branch protection blocks the github-actions bot, configure RELEASE_PUSH_TOKEN as a fine-grained PAT with contents:write.

  Side observation: dry-run flags that bridge/ has unreleased changes since bridge/v0.0.2 (libfossil bump + README), so the next auto-release run will tag bridge/v0.0.3 alongside whatever else changes. (user: [email protected], size: 2072) [annotate] [blame] [check-ins using]

name: Auto-release

# Drives the multi-step EdgeSync release flow: tag any submodule that
# changed since its last <name>/v* tag, bump the matching root go.mod
# pin (commit straight to main as github-actions[bot]), then tag the
# next root v*. Pushing the root tag fires release.yml (goreleaser +
# bones dispatch).
#
# Manual entry point. Click "Run workflow" or:
#   gh workflow run auto-release.yml -f dry_run=true
#   gh workflow run auto-release.yml -f bump_kind=patch

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Report what would happen without pushing anything'
        required: false
        default: false
        type: boolean
      bump_kind:
        description: 'Semver bump kind'
        required: false
        default: patch
        type: choice
        options: [patch, minor, major]

permissions:
  contents: write

concurrency:
  group: auto-release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: main
          # Use a token that can push to main even when branch protection
          # restricts the default GITHUB_TOKEN. If the repo doesn't have
          # branch protection on main this is unnecessary; if it does,
          # configure RELEASE_PUSH_TOKEN as a fine-grained PAT with
          # contents:write on this repo.
          token: ${{ secrets.RELEASE_PUSH_TOKEN || github.token }}

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup git identity
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Run release driver
        env:
          DRY_RUN: ${{ inputs.dry_run }}
          BUMP_KIND: ${{ inputs.bump_kind }}
        run: |
          args=(--ci "--bump=${BUMP_KIND}")
          if [[ "$DRY_RUN" == "true" ]]; then
            args+=(--dry-run)
          fi
          ./scripts/release.sh "${args[@]}"