KAN-196/redesign-release-workflow-defer-version-bump-to-master-merge (#163)

* fix: defer version bump to master merge

The previous workflow bumped version on every develop merge, causing
desync between Cargo.toml version and crates.io. Version 0.2.1 was
bumped on develop but never published.

Move version bumping into release.yml so bump, changelog, publish,
and tag all happen atomically on master merge:

- Delete aggregate-changesets.yml (no more auto-bump on develop)
- Rewrite release.yml to run bump-version.sh on master merge
- Replace ci.yml version-check with changeset-check for master PRs
- Delete scripts/aggregate-changelog.sh (redundant with bump-version.sh)
- Revert version 0.2.1 -> 0.2.0 to sync with master/crates.io
- Remove broken 0.2.1 CHANGELOG entry

KAN-196

* fix: exclude README.md from changeset detection in bump-version.sh

The glob `ls -A .changeset/*.md` matched README.md, causing the script
to think changesets exist when only the README is present. The for loop
also lacked a skip guard, so README.md would be parsed as a changeset
producing garbage changelog entries.

Replace ls glob with find that excludes README.md, and add a basename
check in the iteration loop.

* refactor: extract changelog aggregation into standalone script

bump-version.sh was handling version bumping, changelog aggregation,
changeset cleanup, and git commit in a single script. Split these
concerns:

- bump-version.sh: only bumps versions in Cargo.toml files and runs
  cargo update
- aggregate-changelog.sh: reads changesets, prepends entries to
  CHANGELOG.md with PR link, then deletes processed changeset files

Also fix fragile bump-type parsing by using sed to properly extract
the bump field from within frontmatter boundaries instead of grep -A1
which only matched immediately after the first ---.

* fix: reorder release workflow to validate before push

Previously the release workflow pushed the version bump commit to master
before running validation. If validation failed, master would have a
bumped version with no corresponding crates.io publish.

Reorder steps: bump -> aggregate changelog -> commit -> get version ->
validate -> push -> publish. Validation now runs locally before anything
is pushed.

Also split the workflow into separate visible steps for bump, changelog,
and commit. And handle merge conflicts in the develop sync step with a
warning instead of failing the entire release.

* fix: use robust frontmatter parsing in changeset-check

The grep -A1 approach only found the bump field if it appeared on the
line immediately after ---. Use sed to extract from within the full
frontmatter block, and fall back to "unknown" if parsing fails.

* chore: wire all scripts into nix dev shell

Add aggregate-changelog as a writeShellApplication in flake.nix and
pass all script packages (changeset, aggregate-changelog, bump-version,
publish-crates, validate-release) into shell.nix from the flake.

Remove the duplicate writeShellScriptBin changeset definition from
shell.nix — it now receives the flake's writeShellApplication version
like the other scripts. Defaults to null so standalone nix-shell still
works.

Update CI workflows to use `nix develop --command <name>` consistently
instead of `bash scripts/...` or `nix run .#...`.

* fix: quote variable in parameter expansion to satisfy shellcheck SC2295

writeShellApplication runs shellcheck, which flags unquoted variables
inside parameter expansion patterns.

* fix: address PR review findings for release workflow

- Make changeset-check block master PRs without changesets, with
  [hotfix] PR title bypass
- Add ordering comment for bump-version/aggregate-changelog dependency
- Consolidate duplicate version read into single release step
- Reinstate cleanup trap in aggregate-changelog.sh
- Filter shell.nix scripts individually instead of all-or-nothing guard

* chore: add changeset

* fix: address review findings for release workflow scripts

- Strip leading "- " from changeset descriptions before prepending it
  in aggregate-changelog to prevent double-dash entries
- Remove dead GITHUB_OUTPUT write from bump-version.sh (release.yml
  reads version from Cargo.toml directly)
- Move PR title from inline ${{ }} interpolation to env block in
  changeset-check to prevent shell injection

* fix: normalize changelog bullet prefix per-line in aggregate-changelog

Author: fulsomenko

.changeset/kan-196-redesign-release-workflow-defer-version-bump-to-master-merge.md

@@ -0,0 +1,12 @@
+---
+bump: patch
+---
+
+- fix: address PR review findings for release workflow
+- fix: quote variable in parameter expansion to satisfy shellcheck SC2295
+- chore: wire all scripts into nix dev shell
+- fix: use robust frontmatter parsing in changeset-check
+- fix: reorder release workflow to validate before push
+- refactor: extract changelog aggregation into standalone script
+- fix: exclude README.md from changeset detection in bump-version.sh
+- fix: defer version bump to master merge

.github/workflows/aggregate-changesets.yml

@@ -124,34 +124,43 @@ jobs:
 
           echo "✅ Changeset validated successfully"
 
-  version-check:
-    name: Version Check
+  changeset-check:
+    name: Changeset Check
     if: github.event_name == 'pull_request' && github.base_ref == 'master'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
-      - name: Check version bump
+      - name: Check for changesets
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          CURRENT_VERSION=$(grep -m1 'version = ' Cargo.toml | cut -d'"' -f2)
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")
-          LAST_VERSION="${LAST_TAG#v}"
+          if [[ "$PR_TITLE" == *"[hotfix]"* ]]; then
+            echo "Hotfix PR, skipping changeset check"
+            exit 0
+          fi
 
-          echo "Current version: $CURRENT_VERSION"
-          echo "Last released version: $LAST_VERSION"
-          echo ""
+          if [ ! -d ".changeset" ]; then
+            echo "No .changeset directory found"
+            echo "PRs to master require changesets to trigger a release."
+            echo "Add [hotfix] to the PR title to bypass this check."
+            exit 1
+          fi
 
-          if [ "$CURRENT_VERSION" = "$LAST_VERSION" ]; then
-            echo "❌ Version has not been bumped!"
-            echo ""
-            echo "The version in Cargo.toml ($CURRENT_VERSION) matches the last released version ($LAST_VERSION)."
-            echo "Please bump the version in Cargo.toml before merging to master."
+          CHANGESETS=$(find .changeset -maxdepth 1 -name "*.md" ! -name "README.md" 2>/dev/null || true)
+
+          if [ -z "$CHANGESETS" ]; then
+            echo "No changesets found"
+            echo "PRs to master require changesets to trigger a release."
+            echo "Add [hotfix] to the PR title to bypass this check."
             exit 1
           fi
 
-          echo "✅ Version has been bumped: $LAST_VERSION → $CURRENT_VERSION"
+          echo "Found changesets (release will be triggered on merge):"
+          for changeset in $CHANGESETS; do
+            bump=$(sed -n '/^---$/,/^---$/{ /^bump:/{ s/^bump: *//; p; } }' "$changeset" | tr -d '\r\n')
+            echo "  $changeset (bump: ${bump:-unknown})"
+          done
 
   release-validation:
     name: Release Validation
@@ -167,4 +176,4 @@ jobs:
 
       - name: Validate release build
         run: |
-          nix develop --command bash scripts/validate-release.sh
+          nix develop --command validate-release

.github/workflows/ci.yml

@@ -7,6 +7,10 @@ on:
     types:
       - closed
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Release to crates.io
@@ -20,114 +24,115 @@ jobs:
           fetch-depth: 0
           ref: master
 
-      - name: Get versions
-        id: versions
+      - name: Check for changesets
+        id: check
         run: |
-          CURRENT_VERSION=$(grep -m1 'version = ' Cargo.toml | cut -d'"' -f2)
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")
-          LAST_VERSION="${LAST_TAG#v}"
-
-          echo "current=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          echo "last=$LAST_VERSION" >> $GITHUB_OUTPUT
-
-          # Check if current version is greater than last version using sort -V
-          # Note: sort -V is a GNU extension, available on Ubuntu runners
-          version_gt() {
-            [ "$1" != "$2" ] && [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
-          }
-
-          if version_gt "$CURRENT_VERSION" "$LAST_VERSION"; then
-            echo "should_release=true" >> $GITHUB_OUTPUT
-            echo "Version increased: $LAST_VERSION → $CURRENT_VERSION"
-          elif [ "$CURRENT_VERSION" = "$LAST_VERSION" ]; then
-            echo "should_release=false" >> $GITHUB_OUTPUT
-            echo "Version unchanged ($CURRENT_VERSION), skipping release"
+          if [ ! -d ".changeset" ]; then
+            echo "has_changesets=false" >> "$GITHUB_OUTPUT"
+            echo "No .changeset directory, skipping release"
+            exit 0
+          fi
+
+          CHANGESETS=$(find .changeset -maxdepth 1 -name "*.md" ! -name "README.md" 2>/dev/null || true)
+          if [ -z "$CHANGESETS" ]; then
+            echo "has_changesets=false" >> "$GITHUB_OUTPUT"
+            echo "No changesets found, skipping release"
           else
-            echo "should_release=false" >> $GITHUB_OUTPUT
-            echo "::error::Version decreased: $LAST_VERSION → $CURRENT_VERSION (must be greater)"
-            exit 1
+            echo "has_changesets=true" >> "$GITHUB_OUTPUT"
+            echo "Found changesets:"
+            echo "$CHANGESETS"
           fi
 
       - uses: cachix/install-nix-action@v27
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
           extra_nix_config: |
             experimental-features = nix-command flakes
 
       - name: Setup SSH deploy key
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           ssh-keyscan github.com >> ~/.ssh/known_hosts
 
       - name: Configure Git
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git remote set-url origin git@github.com:fulsomenko/kanban.git
 
-      - name: Aggregate changelog from changesets
-        if: steps.versions.outputs.should_release == 'true'
+      # bump-version reads changesets, aggregate-changelog reads then deletes them.
+      # These two steps must run in this order.
+      - name: Bump version from changesets
+        if: steps.check.outputs.has_changesets == 'true'
         run: |
-          bash scripts/aggregate-changelog.sh
+          nix develop --command bump-version
 
-      - name: Commit changelog update
-        if: steps.versions.outputs.should_release == 'true'
-        env:
-          GIT_SSH_COMMAND: "ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"
+      - name: Aggregate changelog
+        if: steps.check.outputs.has_changesets == 'true'
+        run: |
+          nix develop --command aggregate-changelog "${{ github.event.pull_request.number }}"
+
+      - name: Commit release changes
+        if: steps.check.outputs.has_changesets == 'true'
+        id: release
         run: |
-          git add CHANGELOG.md
-          git commit -m "docs: update changelog for v${{ steps.versions.outputs.current }}" || echo "No changelog changes to commit"
-          git push origin master || echo "Nothing to push"
+          NEW_VERSION=$(grep -m1 'version = ' Cargo.toml | cut -d'"' -f2)
+          echo "new=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Release version: $NEW_VERSION"
+          git add .
+          git commit -m "chore: release v${NEW_VERSION}"
 
       - name: Validate release build
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         run: |
-          nix develop --command bash scripts/validate-release.sh
+          nix develop --command validate-release
+
+      - name: Push release commit
+        if: steps.check.outputs.has_changesets == 'true'
+        env:
+          GIT_SSH_COMMAND: "ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"
+        run: |
+          git push origin master
 
       - name: Publish to crates.io
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
         run: |
-          echo "🚀 Publishing to crates.io..."
+          echo "Publishing to crates.io..."
           nix run .#publish-crates
-          echo "✅ Published successfully"
+          echo "Published successfully"
 
       - name: Tag version
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         env:
           GIT_SSH_COMMAND: "ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"
         run: |
-          git tag "v${{ steps.versions.outputs.current }}"
-          git push origin "v${{ steps.versions.outputs.current }}"
+          git tag "v${{ steps.release.outputs.new }}"
+          git push origin "v${{ steps.release.outputs.new }}"
 
       - name: Create GitHub Release
-        if: steps.versions.outputs.should_release == 'true'
+        if: steps.check.outputs.has_changesets == 'true'
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: v${{ steps.versions.outputs.current }}
+          tag_name: v${{ steps.release.outputs.new }}
           generate_release_notes: true
 
-      - name: Clean up changesets and sync develop
-        if: steps.versions.outputs.should_release == 'true'
+      - name: Sync develop with master
+        if: steps.check.outputs.has_changesets == 'true'
         env:
           GIT_SSH_COMMAND: "ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"
         run: |
-          # Delete changesets on master (after successful publish)
-          if [ -d ".changeset" ]; then
-            find .changeset -maxdepth 1 -name "*.md" ! -name "README.md" -delete
-            git add .changeset/
-          fi
-          git commit -m "chore: clean up changesets for v${{ steps.versions.outputs.current }}" || echo "No changesets to clean up"
-          git push origin master || echo "Nothing to push"
-
-          # Sync develop with master (gets changelog + changeset cleanup)
           git checkout develop
           git pull origin develop
-          git merge origin/master --no-edit
+          if ! git merge origin/master --no-edit; then
+            echo "::warning::Failed to auto-merge master into develop. Manual merge required."
+            git merge --abort
+            exit 0
+          fi
           git push origin develop

.github/workflows/release.yml

@@ -1,24 +1,3 @@
-## [0.2.1] - 2026-02-01 ([#162](https://github.com/fulsomenko/kanban/pull/162))
-
-- # Changesets
-When creating a PR, add a changeset file to describe your changes.
-## Creating a Changeset
-```bash
-nix run .#changeset
-```
-Or create a file `.changeset/<descriptive-name>.md` manually:
-```md
-Brief description of changes for the changelog
-```
-## Bump Types
-- `patch` - Bug fixes, small changes (0.1.0 → 0.1.1)
-- `minor` - New features, backwards compatible (0.1.0 → 0.2.0)
-- `major` - Breaking changes (0.1.0 → 1.0.0)
-On merge to master, changesets are aggregated and the highest bump type determines the version increment.
-- - refactor: extract Sprint::assignable to deduplicate sprint filtering
-- fix: filter completed/cancelled sprints from assignment handlers
-
-
 ## [0.2.0] - 2026-02-01
 
 - - feat(tui): register undo/redo keybindings in CardList provider