ci: release by tag-only publish (no commit to ruleset-protected main)#8
Merged
Conversation
The Release run failed pushing the version-bump commit to main:
`GH013: Repository rule violations` — main is protected by a ruleset
("Protect main": PRs required + status checks), which the semantic-release
direct push violates. Rather than depend on a bypass actor / GitHub App,
decouple releasing from the main commit:
- Version is read from pyproject.toml (bumped via a normal PR, which the
ruleset already requires), not written by the workflow.
- Refuse to run if `v<version>` already exists (forgotten bump guard).
- Build + publish to PyPI + Azure feed + GHCR, then push ONLY the
`v<version>` git tag (tags are outside the branch ruleset).
- Drop semantic-release, the uv.lock amend, and the push to main.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Claude finished @uipreliga's task in 1m 47s —— View job Reviewing PR: Release by tag-only publish
|
akshaylive
added a commit
that referenced
this pull request
Jul 9, 2026
Effectively reverts #8 (tag-only, manual-bump release). The release app has been re-added with a ruleset bypass, so the workflow can once again push the version-bump commit + tag directly to protected main. - Restore the `bump` dispatch input (patch/minor/major, default patch). - Mint a GitHub App installation token and checkout/push as the app (bypasses the "Protect main" ruleset that GITHUB_TOKEN cannot). - semantic-release writes the new version to pyproject.toml + __init__.py, tags v<version>, regenerates the changelog, then we regenerate uv.lock, amend, and push commit + tag to main. - Drop the manual-bump re-release guard and the separate tag-release job (the tag now travels with the bump commit). Public PyPI publishing (OIDC Trusted Publishing) and the best-effort GHCR image are kept. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Release run failed pushing the version-bump commit to
main:mainis protected by a repository ruleset ("Protect main":pull_request+required_status_checks), which the semantic-release direct push violates. (Classic branch-protection API reports "not protected" because rulesets are a separate mechanism.) The original design bypassed this with a GitHub App whose secrets are missing.Approach
Decouple releasing from the
maincommit entirely — no bypass actor / App needed:pyproject.toml(bumped via a normal PR, which the ruleset already requires) — the workflow never rewrites it.v<version>already exists (forgotten-bump protection; PyPI versions are immutable).v<version>git tag (tags are outside the branch ruleset).uv.lockamend, and the push tomain.Net −70/+43 lines.
New release flow
versioninpyproject.toml(+src/coder_eval/__init__.py) via a PR.maindeclares + pushes its tag.First release will publish
0.8.2(currentmainversion, unclaimed on PyPI).🤖 Generated with Claude Code