Release on merge: tag-release promotes Unreleased and tags it #416

Merged

robbertbos merged 1 commit from auto-release into main 2026-09-23 20:34:16 +00:00

Conversation 0 Commits 1 Files changed 11 +503 -72

robbertbos commented 2026-09-23 19:26:47 +00:00

Owner

Copy link

A new tag-release workflow releases every push to main that has something under ## [Unreleased]. The rules are in docs/deployment.md > "Cutting a release".

Under Unreleased	Route
entries	release: promote to ## [vYYYY.M.D] (.N for a second release that day), commit as Waggle Release Bot, tag, push
<!-- release: hold --> or ### Note when rolling out	stage: no release; publish-and-stage builds and deploys staging
nothing, or no Unreleased heading at all, with the newest ## [vX] heading not yet tagged	tag: a release cut by hand in a PR gets its tag on merge
nothing else	none

• Staging only under a hold. publish-and-stage now builds and deploys staging only when the push is held.
• Production path unchanged. release-and-deploy.yaml is untouched: the tag builds, releases and deploys production.
• Only a PR lifts a hold. There is no manual trigger, and release-promote.sh refuses a section that still carries the marker. A failed run can be re-run from the Actions tab; it stops on its own if main has moved on.

Scripts

• release-decide.sh picks the route. It reuses changelog-section.sh, validate-calver-tag.sh and the new newest-calver-tag.sh; assert-newest-calver-tag.sh now uses that last one too.
• release-promote.sh rewrites the CHANGELOG (section, fresh Unreleased, both links). It renames unreleased.md only when it has content, and removes it when it is empty.
• .forgejo/known_hosts pins the host key the push checks.

Tests. test-release-scripts.sh covers every route, the .N numbering, the hold refusal and the in-app notes. Everything passes in a clean container, and changelog-frozen.sh passes on the real history. Locally, the existing tag-based cases fail on this host only because tag.gpgSign is set globally.

Push identity

• The push uses the RELEASE_PUSH_KEY deploy key. The automatic token cannot push to a protected main (forgejo#11159), and a tag it pushes starts no workflow. A deploy-key push counts as the repository owner's (routers/private/serv.go, v15), so the tag does start release-and-deploy.
• Commits come from Waggle Release Bot <release-bot@waggle.rijksapp.nl>. That domain publishes a null MX, so no account can claim the address. The commits are unsigned; "Require signed commits" is off.

This PR lands under a hold, so merging it only stages. The first real release comes from the PR that removes the marker.

Open points

• SSH from the runner. The host key (RSA, SHA256:vcXtpeDOqkTc5F466dN5PiTAAAM+J+vU1A6ejGkpX20) was read from mybee, trust on first use. Whether the runner reaches port 22 shows on the first real run.
• Every release makes open PRs outdated. With "Block merge if pull request is outdated" on, each open PR then needs "Update branch" and a fresh CI run.
• Branch protection is set by hand, not in this PR: required checks CI / * and test-build / *, "Enforce this rule for repository admins", "Block merge if pull request is outdated", and "Whitelist restricted push" with only deploy keys.

A new `tag-release` workflow releases every push to `main` that has something under `## [Unreleased]`. The rules are in `docs/deployment.md` > "Cutting a release". | Under Unreleased | Route | |---|---| | entries | **release**: promote to `## [vYYYY.M.D]` (`.N` for a second release that day), commit as Waggle Release Bot, tag, push | | `<!-- release: hold -->` or `### Note when rolling out` | **stage**: no release; `publish-and-stage` builds and deploys staging | | nothing, or no Unreleased heading at all, with the newest `## [vX]` heading not yet tagged | **tag**: a release cut by hand in a PR gets its tag on merge | | nothing else | none | - **Staging only under a hold.** `publish-and-stage` now builds and deploys staging only when the push is held. - **Production path unchanged.** `release-and-deploy.yaml` is untouched: the tag builds, releases and deploys production. - **Only a PR lifts a hold.** There is no manual trigger, and `release-promote.sh` refuses a section that still carries the marker. A failed run can be re-run from the Actions tab; it stops on its own if `main` has moved on. **Scripts** - `release-decide.sh` picks the route. It reuses `changelog-section.sh`, `validate-calver-tag.sh` and the new `newest-calver-tag.sh`; `assert-newest-calver-tag.sh` now uses that last one too. - `release-promote.sh` rewrites the CHANGELOG (section, fresh Unreleased, both links). It renames `unreleased.md` only when it has content, and removes it when it is empty. - `.forgejo/known_hosts` pins the host key the push checks. **Tests.** `test-release-scripts.sh` covers every route, the `.N` numbering, the hold refusal and the in-app notes. Everything passes in a clean container, and `changelog-frozen.sh` passes on the real history. Locally, the existing tag-based cases fail on this host only because `tag.gpgSign` is set globally. **Push identity** - The push uses the `RELEASE_PUSH_KEY` deploy key. The automatic token cannot push to a protected `main` (forgejo#11159), and a tag it pushes starts no workflow. A deploy-key push counts as the repository owner's (`routers/private/serv.go`, v15), so the tag does start `release-and-deploy`. - Commits come from `Waggle Release Bot <release-bot@waggle.rijksapp.nl>`. That domain publishes a null MX, so no account can claim the address. The commits are unsigned; "Require signed commits" is off. **This PR lands under a hold**, so merging it only stages. The first real release comes from the PR that removes the marker. **Open points** - **SSH from the runner.** The host key (RSA, `SHA256:vcXtpeDOqkTc5F466dN5PiTAAAM+J+vU1A6ejGkpX20`) was read from mybee, trust on first use. Whether the runner reaches port 22 shows on the first real run. - **Every release makes open PRs outdated.** With "Block merge if pull request is outdated" on, each open PR then needs "Update branch" and a fresh CI run. - **Branch protection is set by hand, not in this PR:** required checks `CI / *` and `test-build / *`, "Enforce this rule for repository admins", "Block merge if pull request is outdated", and "Whitelist restricted push" with only deploy keys.

robbertbos added 1 commit 2026-09-23 19:26:47 +00:00

Release on merge: promote Unreleased and tag from publish-and-stage ... 23dc2ded55

A push to main is now judged from CHANGELOG.md by release-decide.sh.
Entries under Unreleased are promoted to a dated CalVer section
(release-promote.sh), committed as Waggle Release Bot, tagged and pushed
with a write deploy key; the tag runs release-and-deploy unchanged. A
'<!-- release: hold -->' marker or a "Note when rolling out" section
routes the push to staging instead, which is now the only time staging
builds. An empty Unreleased with an untagged newest section gets its
tag, so a release cut by hand in a PR still deploys on merge. A manual
dispatch ignores the hold.

The deploy key is needed because the automatic token can neither push
to protected main nor start a workflow with the tag it pushes; a
deploy-key push counts as the repository owner's. The push pins the
code.overheid.nl host key in .forgejo/known_hosts.

unreleased.md is renamed to the version only when it has content and
removed when empty. This PR lands under a hold, so its own merge only
stages.

robbertbos force-pushed auto-release from 23dc2ded55 to 23e8b63c17 2026-09-23 19:31:22 +00:00 Compare

robbertbos force-pushed auto-release from 23e8b63c17 to ca397cf2d4 2026-09-23 19:36:25 +00:00 Compare

robbertbos force-pushed auto-release from ca397cf2d4 to cf0afbb1be 2026-09-23 19:38:28 +00:00 Compare

robbertbos changed title from Release on merge: promote Unreleased and tag from publish-and-stage to Release on merge: cut-release promotes Unreleased and tags it 2026-09-23 19:38:42 +00:00

robbertbos force-pushed auto-release from cf0afbb1be to 622480904e 2026-09-23 19:52:19 +00:00 Compare

robbertbos force-pushed auto-release from 622480904e to 7aef31357f 2026-09-23 19:56:14 +00:00 Compare

robbertbos changed title from Release on merge: cut-release promotes Unreleased and tags it to Release on merge: tag-release promotes Unreleased and tags it 2026-09-23 19:56:50 +00:00

robbertbos force-pushed auto-release from 7aef31357f to 225727c08d 2026-09-23 20:17:11 +00:00 Compare

robbertbos scheduled this pull request to auto merge when all checks succeed 2026-09-23 20:17:51 +00:00

robbertbos referenced this pull request from a commit 2026-09-23 20:27:40 +00:00

Cache Node and the uv binary in CI

robbertbos referenced this pull request 2026-09-23 20:27:53 +00:00

Cache Node and the uv binary in CI #420

robbertbos merged commit 225727c08d into main 2026-09-23 20:34:16 +00:00

robbertbos deleted branch auto-release 2026-09-23 20:34:16 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

nldd ds

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

nldd ds

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

robbertbos/waggle!416

No description provided.