Releases are cut from GitHub Actions. Branch protection on master stays enabled.
Pre-built binaries: GitHub releases.
Settings → Environments → New environment → release.
Recommended:
- Required reviewers before publish
- Deployment branches →
masteronly
Settings → Actions → General → workflow permissions Read and write.
- Actions → Release → Run workflow → patch (default), minor, or major
- Approve the release environment if reviewers are configured
- When the job finishes, merge the Makefile bump PR if one was opened (so
mastermatches the release)
The workflow refuses to publish if that tag or release already exists.
| Bump | Example (latest v1.3.0) |
|---|---|
| patch | v1.3.1 |
| minor | v1.4.0 |
| major | v2.0.0 |
The starting point is the latest stable GitHub release tag (drafts and pre-releases excluded). If there are no releases yet, the Makefile VERSION on master is used.
- Compute the new version from the latest release plus your bump choice.
- Edit the Makefile in the CI workspace to that version (this happens before build; it does not commit to
masteryet). - Run tests on that tree.
- Build binaries. The job checks that the Makefile matches the release version, then compiles with
-ldflagssodwatch --versionis correct. - Publish the GitHub Release and upload tarballs.
- Open a pull request to update
VERSIONonmaster, because branch protection requires a PR for commits onmaster.
Step 6 does not change what is inside the tarballs from step 4. It only brings master in line for anyone cloning the repo and running make build locally.