fix: restore auto-bump in release workflow #5
Conversation
Previously, when the Release workflow was triggered by workflow_run (after CI completes on main), it would skip the release if the current version tag already existed. This required manual version bumps before each release. Now, when triggered by workflow_run: - If current version tag doesn't exist → release with current version - If current version tag exists → auto-bump patch version, update Cargo.toml, then release This makes releases fully automatic after merging PRs to main.
|
Warning Rate limit exceeded@rishitank has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 17 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
WalkthroughThe release workflow now prevents auto-bumping of patch versions when tags already exist, instead emitting notices and setting should_release to false. A RELEASE_TOKEN secret is now required for the bump-version path; GITHUB_TOKEN usage has been replaced with RELEASE_TOKEN for authentication in relevant steps. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
Pre-merge checks✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
rishitank
force-pushed
the
fix/release-workflow-v2
branch
from
dc9d0b8 to
9ec4732
Compare
rishitank
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/release.yml (2)
111-114: Incomplete guidance in notice messages.The PR objectives mention three supported release methods, but the notices only list two. Additionally, the workflow_dispatch option requires RELEASE_TOKEN but this isn't clarified in the notice.
🔎 Suggested enhancement for completeness
- echo "::notice::Tag v$CURRENT_VERSION already exists. To create a new release, either:" - echo "::notice:: 1. Bump the version in Cargo.toml before merging to main" - echo "::notice:: 2. Use workflow_dispatch with bump_type to auto-bump and release" + echo "::notice::Tag v$CURRENT_VERSION already exists. To create a new release, choose one of:" + echo "::notice:: 1. Bump the version in Cargo.toml before merging to main (recommended)" + echo "::notice:: 2. Use workflow_dispatch with bump_type (requires RELEASE_TOKEN secret)" + echo "::notice:: 3. Push a tag directly: git tag v2.2.0 && git push origin v2.2.0" echo "should_release=false" >> $GITHUB_OUTPUT
156-164: Remove redundant environment variable.The
GITHUB_TOKENenvironment variable on line 164 is unnecessary because the checkout action on line 144-146 already configured git to useRELEASE_TOKENfor authentication. Git will automatically use that token for the push operation.Additionally, setting an environment variable named
GITHUB_TOKENto the value ofRELEASE_TOKENis confusing.🔎 Proposed cleanup
- name: Commit version bump run: | VERSION="${{ needs.check.outputs.version }}" git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" git add Cargo.toml git commit -m "chore: bump version to $VERSION [skip ci]" git push - env: - GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (3)
.github/workflows/release.yml (3)
128-129: LGTM! Clear documentation of token requirements.The comments effectively explain the RELEASE_TOKEN requirement and provide context about bypass permissions for protected branches.
135-142: LGTM! Proper secret validation with clear error messages.The check correctly validates that RELEASE_TOKEN is configured and provides actionable guidance if it's missing. The error messages clearly explain both the requirement and the alternatives.
146-146: LGTM! Correct token usage for protected branch access.Using RELEASE_TOKEN for checkout is necessary to enable the subsequent git push to the protected main branch.
Uses RELEASE_TOKEN (a PAT with Contents write permission) to bypass branch protection when auto-bumping the version. Setup required: 1. Create a Fine-Grained PAT at GitHub Settings → Developer Settings → Personal Access Tokens 2. Grant it 'Contents: Read and write' permission for this repo 3. Add it as a repository secret named RELEASE_TOKEN The workflow falls back to GITHUB_TOKEN if RELEASE_TOKEN is not set, which will fail on protected branches but work on unprotected ones.
rishitank
force-pushed
the
fix/release-workflow-v2
branch
from
9ec4732 to
8f78d7b
Compare
Problem
The auto-bump logic fails because branch protection rules prevent workflows from pushing directly to
mainusing the defaultGITHUB_TOKEN.Solution
Use a Personal Access Token (PAT) stored as
RELEASE_TOKENsecret. This token can bypass branch protection because it represents your user account, not the GitHub Actions bot.One-time setup required:
Create a Fine-Grained PAT:
RELEASE_WORKFLOWrishitank/context-engineAdd as repository secret:
RELEASE_TOKENHow it works
After merging this PR and setting up
RELEASE_TOKEN:maintriggers CIv2.1.0), it auto-bumps tov2.1.1RELEASE_TOKEN(bypasses protection)Changes
${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}for checkout and pushGITHUB_TOKENifRELEASE_TOKENnot set (will fail on protected branches)