Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .craft.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
minVersion: "3.9.0"
changelog:
policy: auto
# Add a short AI summary above the entries of each release. The Release
# workflow gives Craft the workflow token for it.
aiSummary:
levels: [release]
# Write the version only to `@sentry/roach` (packages/roach/package.json).
# See the script for why Craft does not do it on its own.
preReleaseCommand: sh .github/scripts/bump-version.sh
Expand Down
21 changes: 15 additions & 6 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,21 @@
on:
workflow_dispatch:
inputs:
version:
description: Version bump type
bump:
description: Version bump type (ignored when version is set). auto picks it from the commits; pre cuts a prerelease of that version.
required: true
type: choice
default: minor
default: auto
options:
- minor
- auto
- pre
- patch
- minor
- major
version:
description: Exact version override (for example, 0.212.0)
required: false
type: string
force:
description: Force release (bypass blockers)
required: false
Expand All @@ -22,6 +28,8 @@

permissions:
contents: read
# Craft writes AI changelog summaries with the workflow token.
copilot-requests: write

jobs:
release:
Expand Down Expand Up @@ -50,9 +58,10 @@
run: .github/scripts/drop-floating-tags.sh

- name: Prepare release
uses: getsentry/craft@2e29b0819113d334c15da3d8cac2138cb9dc111a # 3.9.0
uses: getsentry/craft@v3
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
version: ${{ inputs.version }}
version: ${{ inputs.version || inputs.bump }}
force: ${{ inputs.force && 'true' || 'false' }}
llm_api_key: ${{ github.token }}

Check failure on line 67 in .github/workflows/release.yml

View check run for this annotation

@sentry/warden / warden: security-review

Floating craft@v3 runs in privileged release job

Unpinning getsentry/craft to the mutable v3 tag lets a tag rewrite run arbitrary code with the Sentry Release Bot token and release authority. Pin Craft to a full commit SHA again.
Comment thread
sentry-junior[bot] marked this conversation as resolved.
Resolved
Comment thread
sentry-junior[bot] marked this conversation as resolved.
Resolved
10 changes: 7 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -958,14 +958,18 @@ does not exist does.

## Release

Run the `Release` workflow, and choose `minor`, `patch`, or `major`. Craft
(`.craft.yml`) makes a `release/<version>` branch and asks for approval in
Run the `Release` workflow. Choose a `bump`: `auto` (the default), `pre`,
`patch`, `minor`, or `major`. `auto` picks the bump from the commits. `pre`
makes a prerelease of the version that `auto` picks. To release an exact
version, type it in `version`. Craft (`.craft.yml`) makes a
`release/<version>` branch and asks for approval in
[getsentry/publish](https://github.com/getsentry/publish). When a release
manager accepts it, Craft:

- copies the image `ghcr.io/getsentry/roach:<sha>` to `:<version>`.
- makes the GitHub release `v<version>`, with the changelog, and moves the
`v<major>` tag. Repositories use the action as `getsentry/roach@v<major>`.
`v<major>` tag. When the changelog has more than 5 entries, Craft adds a
short AI summary above them. Repositories use the action as `getsentry/roach@v<major>`.
- publishes `@sentry/roach` to npm: the tarball that the `package` job of
`CI` uploads for the release commit. Craft publishes only
`sentry-roach-<version>.tgz`, and CI makes sure that it has `LICENSE` and
Expand Down
Loading