Skip to content
Open
Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
b9ae430
ci(release): Switch from action-prepare-release to Craft
BYK Jan 9, 2026
3c240d2
ci(release): Restore GitHub App token authentication
BYK Jan 9, 2026
f101fbf
ci(release): Restore GitHub App token authentication
BYK Jan 9, 2026
a8c5f38
fix: Pin actions to SHA and add permissions blocks
BYK Jan 10, 2026
95d4e72
fix: Restore PR trigger and version extraction for auto-release
BYK Jan 10, 2026
f88812d
fix: Use correct action version SHAs (restore original versions)
BYK Jan 10, 2026
d17ff7e
fix: Use correct action version SHAs (restore original versions)
BYK Jan 10, 2026
a902463
fix: Address review feedback (inputs context, permissions, triggers)
BYK Jan 10, 2026
5348f80
fix: Add Node.js setup to release workflow
BYK Jan 10, 2026
e912696
fix: Clean up action version comments
BYK Jan 12, 2026
480fe95
Update Craft SHA to 1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce
BYK Jan 13, 2026
91807f2
Update Craft SHA to 1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce
BYK Jan 13, 2026
fbb531f
Add explicit permissions block to build.yml
BYK Jan 13, 2026
b4ba2d3
Add explicit permissions block to codeql-analysis.yml
BYK Jan 13, 2026
e07b23e
Add explicit permissions block to create-issue-for-unreferenced-prs.yml
BYK Jan 13, 2026
c15b599
Add explicit permissions block to enforce-license-compliance.yml
BYK Jan 13, 2026
e26bc72
Revert permissions changes to build.yml
BYK Jan 13, 2026
df2832a
Revert permissions changes to codeql-analysis.yml
BYK Jan 13, 2026
657b2e0
Revert permissions changes to create-issue-for-unreferenced-prs.yml
BYK Jan 13, 2026
64e73aa
Revert permissions changes to enforce-license-compliance.yml
BYK Jan 13, 2026
0b2d1e4
fix: revert extraneous changes to non-release workflow files
BYK Jan 14, 2026
6855820
fix: clean up release.yml formatting and version comments
BYK Jan 14, 2026
0ad41f4
build(craft): Update Craft action to c6e2f04
BYK Jan 14, 2026
ec4ad57
chore: add unlabeled trigger to changelog-preview
BYK Jan 14, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 32 additions & 55 deletions .github/workflows/auto-release.yml
Original file line number Diff line number Diff line change
@@ -1,60 +1,37 @@
name: 'Gitflow: Auto prepare release'
on:
pull_request:
types:
- closed
branches:
- master

# This workflow tirggers a release when merging a branch with the pattern `prepare-release/VERSION` into master.
workflow_dispatch:
inputs:
version:
description: Version to release (or "auto")
required: false
force:
description: Force a release even when there are release-blockers

This comment was marked as outdated.

required: false
merge_target:
description: Target branch to merge into
required: false
jobs:
release:
runs-on: ubuntu-24.04
name: 'Prepare a new version'

runs-on: ubuntu-latest
name: Release a new version
steps:
- name: Get auth token
id: token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v6
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0

# https://github.com/actions-ecosystem/action-regex-match
- uses: actions-ecosystem/action-regex-match@v2
id: version-regex
with:
# Parse version from head branch
text: ${{ github.head_ref }}
# match: preprare-release/xx.xx.xx
regex: '^prepare-release\/(\d+\.\d+\.\d+)(?:-(alpha|beta|rc)\.\d+)?$'

- name: Extract version
id: get_version
run: |
version=${{ steps.version-regex.outputs.match }}
version=${version/'prepare-release/'/''}
echo "version=$version" >> $GITHUB_OUTPUT
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: 'package.json'

- name: Prepare release
uses: getsentry/action-prepare-release@v1
if:
github.event.pull_request.merged == true && steps.version-regex.outputs.match != '' &&
steps.get_version.outputs.version != ''
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ steps.get_version.outputs.version }}
force: false
merge_target: master
craft_config_from_merge_target: true
- name: Get auth token
id: token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@v4
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/craft@v2
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ inputs.version }}
force: ${{ inputs.force }}
merge_target: ${{ inputs.merge_target }}
craft_config_from_merge_target: 'true'
13 changes: 13 additions & 0 deletions .github/workflows/changelog-preview.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
name: Changelog Preview
on:
pull_request:
types:
- opened
- synchronize
- reopened
- edited
- labeled
jobs:
changelog-preview:
uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2
secrets: inherit
55 changes: 25 additions & 30 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,40 +3,35 @@ on:
workflow_dispatch:
inputs:
version:
description: Version to release
required: true
description: Version to release (or "auto")
required: false
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional version input lacks default value

Low Severity

The version input was changed from required: true to required: false, with the description updated to "(or 'auto')". However, no default value was added. If a user triggers the workflow without providing a version, github.event.inputs.version passes an empty string to the Craft action rather than "auto". This could cause unexpected behavior if Craft doesn't treat empty strings equivalently to "auto" versioning.

Fix in Cursor Fix in Web

force:
description: Force a release even when there are release-blockers (optional)
description: Force a release even when there are release-blockers
required: false
merge_target:
description: Target branch to merge into. Uses the default branch as a fallback (optional)
description: Target branch to merge into
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

q: How does craft handle this case?

required: false
default: master
jobs:
release:
runs-on: ubuntu-24.04
name: 'Release a new version'
runs-on: ubuntu-latest
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

m: I think pinning to latest would make our CI more brittle here, is this required?

name: Release a new version
steps:
- name: Get auth token
id: token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@v6
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v6
with:
node-version-file: 'package.json'
- name: Prepare release
uses: getsentry/action-prepare-release@v1
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ github.event.inputs.version }}
force: ${{ github.event.inputs.force }}
merge_target: ${{ github.event.inputs.merge_target }}
craft_config_from_merge_target: true
- name: Get auth token
id: token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@v4
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/craft@v2
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ inputs.version }}
force: ${{ inputs.force }}
merge_target: ${{ inputs.merge_target }}
craft_config_from_merge_target: 'true'
Loading