From 879493297ffa0e944f9f630acc1535150859466c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Wed, 4 Nov 2026 05:41:34 -0800 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=91=B7=20ci(release):=20drop=20finali?= =?UTF-8?q?ze=20release=20environment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release environment only allows v* tags, but the finalize workflow is dispatched from main, so its job was rejected before it ran. The job reads nothing from the environment: it uses github.token and checks the downloaded artifacts against the Marketplace acceptance receipt. Write access moves from the workflow to the finalize job, so the permission is scoped to the one job that needs it. --- .github/workflows/finalize-github-release.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/finalize-github-release.yaml b/.github/workflows/finalize-github-release.yaml index 753ebc2..7af7b65 100644 --- a/.github/workflows/finalize-github-release.yaml +++ b/.github/workflows/finalize-github-release.yaml @@ -23,8 +23,7 @@ on: required: true type: string permissions: - actions: read - contents: write + contents: read concurrency: group: release-refs/tags/${{ inputs.tag }} cancel-in-progress: false @@ -32,7 +31,9 @@ jobs: finalize: name: 🚀 Finalize GitHub Release runs-on: ubuntu-26.04 - environment: release + permissions: + actions: read + contents: write steps: - name: 🔍 Verify the original tag run id: source From 86b4e94c359082369aa8687d68f9af4e01d1d5d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Wed, 4 Nov 2026 05:41:41 -0800 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=91=B7=20ci(release):=20open=20post-r?= =?UTF-8?q?elease=20PR=20after=20finalize?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A release recovered through this workflow skipped the version bump that the tag run opens after the GitHub release, so the next dev version never got its pull request. The finalize workflow now runs the same prepare and PR jobs as release.yaml, with the same App token handling. The release-auth environment allows main, the branch this workflow is dispatched from. --- .../workflows/finalize-github-release.yaml | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/.github/workflows/finalize-github-release.yaml b/.github/workflows/finalize-github-release.yaml index 7af7b65..c4bc05b 100644 --- a/.github/workflows/finalize-github-release.yaml +++ b/.github/workflows/finalize-github-release.yaml @@ -90,3 +90,74 @@ jobs: title: ${{ inputs.tag }} notes-file: ${{ runner.temp }}/notes/release-notes.md assets-directory: dist + post-release-prepare: + name: 🏷️ Prepare post-release version bump + needs: finalize + runs-on: ubuntu-26.04 + permissions: + contents: read + outputs: + base-commit: ${{ steps.change.outputs.base-commit }} + candidate-commit: ${{ steps.change.outputs.candidate-commit }} + branch: ${{ steps.change.outputs.branch }} + next-version: ${{ steps.change.outputs.next-version }} + artifact-id: ${{ steps.upload.outputs.artifact-id }} + steps: + - name: 📥 Check out code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: main + fetch-depth: 0 + persist-credentials: false + - name: 🏷️ Prepare the exact version change + id: change + uses: tox-dev/github-workflows/prepare-jetbrains-post-release@2c1f5e4ceda37c41eb8367b5cbeaa741aa60a566 # 6.5.2 + with: + tag: ${{ inputs.tag }} + app-slug: tox-dev-pyvenvmanage-release + github-token: ${{ github.token }} + output-dir: ${{ runner.temp }}/post-release + - name: 📤 Upload the version change + id: upload + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: post-release-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ runner.temp }}/post-release/* + if-no-files-found: error + post-release: + name: 🔀 Open post-release version bump PR + needs: post-release-prepare + runs-on: ubuntu-26.04 + permissions: + contents: read + environment: release-auth + steps: + - name: 🔑 Create release App token + id: token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.RELEASE_APP_CLIENT_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: ${{ github.event.repository.name }} + permission-contents: write + permission-pull-requests: write + permission-issues: write + - name: 📩 Download the version change + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + artifact-ids: ${{ needs.post-release-prepare.outputs.artifact-id }} + path: ${{ runner.temp }}/post-release + - name: 🔀 Open the post-release PR + uses: tox-dev/github-workflows/publish-post-release-pr@2c1f5e4ceda37c41eb8367b5cbeaa741aa60a566 # 6.5.2 + env: + GH_TOKEN: ${{ steps.token.outputs.token }} + with: + base-commit: ${{ needs.post-release-prepare.outputs.base-commit }} + branch: ${{ needs.post-release-prepare.outputs.branch }} + title: Bump version to ${{ needs.post-release-prepare.outputs.next-version }} + body-file: ${{ runner.temp }}/post-release/body.md + paths-file: ${{ runner.temp }}/post-release/paths.tsv + allowed-paths: gradle.properties + bundle: ${{ needs.post-release-prepare.outputs.candidate-commit != '' && format('{0}/post-release/candidate.bundle', runner.temp) || '' }} + candidate-commit: ${{ needs.post-release-prepare.outputs.candidate-commit }}