ci(release): consolidate GitHub approval and retain SignPath review / 合并 GitHub 审批并保留 SignPath 手工确认#6626
Merged
SivanCola merged 4 commits intoJul 17, 2026
Conversation
Problem: Stable CLI, npm, and Desktop tags started independent workflows, so one stable release required repeated GitHub environment approvals and separate coordination. Root cause: Each publisher owned its stable tag trigger and protected environment instead of sharing one validated release decision. Fix: Add a stable release orchestrator that validates the atomic three-tag set, requests one environment approval, and invokes guarded reusable publishers in parallel. Preserve standalone prerelease and recovery gates, harden version resolution, and add workflow contract coverage and release documentation. Verification: - actionlint v1.7.7 on release workflows and CI - bash scripts/release-workflows.test.sh - ./scripts/cache-guard.sh - node --test scripts/release-notes.test.mjs - go test ./...
github-actions
Bot
added
v2
Problem: The reusable publishers trusted a caller path on any ref, rebuilt mutable tags after approval, and the new actionlint gate failed on an unquoted keychain list. Root cause: The orchestrator passed tag names but not its approved commit, while child guards did not require a protected caller ref or matching workflow SHA. The macOS keychain command also relied on shell word splitting. Fix: Require protected caller context, propagate the approved CLI tag and SHA, check out the immutable commit, and revalidate remote tags before publication. Preserve keychain arguments with a Bash array and document the repository-write trust boundary. Verification: - bash scripts/release-workflows.test.sh - go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 on all release workflows - ./scripts/cache-guard.sh - node --test scripts/release-notes.test.mjs - go test ./... - git diff --check
Problem: The release workflow contract test passed locally but failed in GitHub Actions because the lint runner does not provide ripgrep. Root cause: The test script used rg only for simple regular-expression assertions even though CI does not install that optional tool. Fix: Use portable grep -E assertions throughout the release workflow contract test. Verification: - env PATH=/usr/bin:/bin:/usr/sbin:/sbin bash scripts/release-workflows.test.sh - go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 on all release workflows - git diff --check
Context: The release workflow now consolidates GitHub environment approval, while SignPath manual confirmations remain an intentional second-party control. Change: Clarify workflow comments and the release runbook so the one-approval claim applies only to GitHub. Document that the AMD64 and ARM64 signing requests can each require manual SignPath confirmation. Verification: - bash scripts/release-workflows.test.sh - go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 on all release workflows - git diff --check
SivanCola
changed the title
SivanCola
marked this pull request as ready for review
July 17, 2026 18:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
main-v2commitreleaseenvironment once, then invoke all three publishers in parallelWhy
A stable release currently starts three independent workflows, each with its own GitHub environment deployment. This change consolidates those GitHub approvals into one reviewed stable release decision while preserving recovery and prerelease paths. SignPath remains an independent second-party control and continues to require manual confirmation for Windows release signing.
Approval behavior
release-environment approval starts the CLI, npm, and Desktop stable publishers.release-signing; the AMD64 and ARM64 requests can each require a manual confirmation.Compatibility
vX.Y.Z,npm-vX.Y.Z, anddesktop-vX.Y.ZreleaseapprovalSecurity model
writeaccess remains privileged because the current publication credentials are repository-level Actions secrets. Strict separation from repository writers requires a follow-up migration to protected environment secrets or provider-side OIDC/trusted publishing.Verification
bash scripts/release-workflows.test.shgo run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7on the release workflows./scripts/cache-guard.shnode --test scripts/release-notes.test.mjsgo test ./...git diff --check