ci(release): Move to Craft auto versioning by sentry-junior[bot] · Pull Request #567 · getsentry/warden

sentry-junior · 2026-11-06T12:58:34Z

BYK asked to move the Craft repos to the latest Craft release workflow, with auto and the full bump set. This makes warden's Release workflow match getsentry/junior, and lets Craft read warden's release tags with no workarounds.

What changed

release.yml now uses getsentry/craft@v3 (floating v3 tag) instead of getsentry/action-prepare-release, with version: ${{ inputs.version || inputs.bump }}.
Inputs: bump (auto, pre, patch, minor, major; default auto), an optional exact version, and force. Craft now resolves the version.
Added permissions (contents: read, copilot-requests: write) and llm_api_key: ${{ github.token }}, the same as junior. This does nothing until .craft.yml sets changelog.aiSummary.
.craft.yml gets minVersion: 3.11.1. Older Craft rejects bump types and auto (2.14.0), pre (3.9.0), and moves floating tags on prereleases (fixed in 3.11.1).
The Action bundle is now committed to main. dist/action/ (the ncc bundle files only) is tracked and marked linguist-generated in .gitattributes. The CI build job rebuilds it and bin/check-action-dist.sh fails when the result differs from the committed files, including new or removed chunks. On same-repo PRs, the new action-dist.yml rebuilds the bundle and commits it back to the PR branch with a release bot app token, so CI runs again on that commit. It runs as two jobs. build runs the PR install and build with no secrets and uploads the bundle as an artifact. commit creates the token, downloads the artifact and runs bin/commit-action-dist.sh (git add, commit and push only, with hooks off). It runs no install or build, and a push after the branch moved is not a fast-forward and fails. Dependabot PRs get no secrets, so they skip this job. Fork and Dependabot PRs can't get the auto-commit, so contributors there run pnpm build:action and commit dist/action/ (CONTRIBUTING.md, AGENTS.md).
No more detached release tags, and Craft moves v0. update-major-tag.yml and bin/update-major-tag.sh are removed. Craft's github target tags the release commit, which main reaches after Craft merges the release branch back. On stable releases it also moves v0 there (floatingTags: ['v{major}']). Since Craft 3.11.1 (getsentry/craft#969), a prerelease never moves v0, and the previous-release lookup skips tags without a full major.minor.patch, so v0 on the release commit does not hide v0.53.0. The release commit has the committed dist/action/, so @v0 and @vX.Y.Z run the same bundle.
Removed bin/craft-release-tags.sh (and its release.yml step) and bin/publish-action-bundle.sh. specs/release-process.md describes the new flow.

Why the old flow existed

dist/ was gitignored, so the bundle could only live on a commit off main. After each release, a workflow built it, committed it on top of the release tag, and force-moved vX.Y.Z and v0 there. It left vX.Y.Z-src on the source commit. main reached only those -src tags, which Craft reads as prereleases, so this PR first needed a tag remap script. Committing the bundle to main (the actions/typescript-action pattern) removes the need for all of it.

First release after merge

main still reaches only the old v0.52.0-src and v0.46.0 tags. Existing tags are not changed.

Run the first release with an exact version, for example 0.53.0. 0.52.0-src reads as a prerelease, so auto and the bump types would compute from 0.46.0 and pick a version that already exists.
Its changelog starts at v0.46.0, the latest stable tag main reaches, so it repeats the 0.47.0 to 0.52.0 entries. Trim them on the release/0.53.0 branch before you approve the publish request.
From the next release on, auto works, because v0.53.0 is on main.

Verification

pnpm build:action output is deterministic, the same on Node 22 and Node 24, and byte-identical to the dist/action on the published v0.52.0 tag (all 50 files).
bin/check-action-dist.sh passes on the committed bundle after a rebuild, and fails on a changed file and on an untracked new chunk.
git check-ignore confirms .d.ts and .map output and packages/*/dist stay ignored.
validate-action-layout --require-dist passes.
Craft 3.11.1 (npx @sentry/craft@3.11.1 changelog) in a scratch repo with v0 and v0.53.0 on the same commit (both annotated, and both lightweight): git describe --tags --match 'v*' returns v0, and Craft picks v0.53.0 as the base. Craft source at 3.11.1 skips floating tags for prereleases in updateFloatingTags.
bin/commit-action-dist.sh against a local bare remote: a changed and a new chunk were committed and pushed to the PR branch.
actionlint 1.7.12 passes. Its only finding is copilot-requests, a scope it doesn't know yet (same on junior's release.yml). shellcheck --shell=sh --enable=check-extra-masked-returns passes on the new scripts.
pnpm lint and typecheck pass. pnpm test: 2091 pass. The 9 src/skills/remote.test.ts real-git tests fail in my sandbox only, because its git wrapper rejects the test's commit author. CI is the source of truth there.
I did not run craft prepare end to end, and the Release workflow was not triggered.

The bundle went in as three commits (part 1 to 3) because the sandbox's push proxy rejects large packs.

via @BYK.

--

View Session [Sentry]

Switch the Release workflow from action-prepare-release to getsentry/craft@v3 with the full bump set (auto, pre, patch, minor, major; default auto), an optional exact version override, and force, matching getsentry/junior. Craft reads the reachable vX.Y.Z-src tags as prereleases, so auto and bump types would promote 0.52.0-src to 0.52.0. Map the source tags back to vX.Y.Z in the job checkout before Craft runs. Set minVersion 3.9.0 so Craft allows auto, bump types, and pre. Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

cursor

Stale Bugbot comment from a previous run.

vercel · 2026-11-06T13:06:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
warden-prod	Ready	Preview	Nov 6, 2026 2:50pm UTC

@v0

A pre release publishes a GitHub Release, and update-major-tag.yml moved v0 to it, so @v0 users would run the prerelease. Move the bundle commit and tag updates into bin/publish-action-bundle.sh and skip the major tag when the version has a prerelease suffix.

Craft could not read warden's releases because each vX.Y.Z tag pointed at a detached commit holding dist/action, so main only reached vX.Y.Z-src. Commit the ncc bundle to main instead and check its freshness in CI, so Craft's github target tags a release commit that main reaches. - Track dist/action bundle files, mark them linguist-generated - CI fails when a rebuilt bundle differs from the committed one - Remove the tag remap, -src tags and the detached bundle commit - update-major-tag.yml only moves vX, and skips prereleases Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

Built with pnpm build:action from the current sources (unchanged from main 95d26a7). The files are byte-identical to the v0.52.0 bundle, and Node 22 and Node 24 builds match. Split in parts to fit the push size limit. Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

+        model: model.id,
+        messages,
+        stream: true,
+        prompt_cache_key: (model.baseUrl.includes("api.openai.com") && cacheRetention !== "none") ||


+    const isTogether = provider === "together" || baseUrl.includes("api.together.ai") || baseUrl.includes("api.together.xyz");
+    const isMoonshot = provider === "moonshotai" || provider === "moonshotai-cn" || baseUrl.includes("api.moonshot.");
+    const isOpenRouter = provider === "openrouter" || baseUrl.includes("openrouter.ai");
+    const isCloudflareWorkersAI = provider === "cloudflare-workers-ai" || baseUrl.includes("api.cloudflare.com");


+    const isMoonshot = provider === "moonshotai" || provider === "moonshotai-cn" || baseUrl.includes("api.moonshot.");
+    const isOpenRouter = provider === "openrouter" || baseUrl.includes("openrouter.ai");
+    const isCloudflareWorkersAI = provider === "cloudflare-workers-ai" || baseUrl.includes("api.cloudflare.com");
+    const isCloudflareAiGateway = provider === "cloudflare-ai-gateway" || baseUrl.includes("gateway.ai.cloudflare.com");


+    const isOpenRouter = provider === "openrouter" || baseUrl.includes("openrouter.ai");
+    const isCloudflareWorkersAI = provider === "cloudflare-workers-ai" || baseUrl.includes("api.cloudflare.com");
+    const isCloudflareAiGateway = provider === "cloudflare-ai-gateway" || baseUrl.includes("gateway.ai.cloudflare.com");
+    const isNvidia = provider === "nvidia" || baseUrl.includes("integrate.api.nvidia.com");


+    const isCloudflareWorkersAI = provider === "cloudflare-workers-ai" || baseUrl.includes("api.cloudflare.com");
+    const isCloudflareAiGateway = provider === "cloudflare-ai-gateway" || baseUrl.includes("gateway.ai.cloudflare.com");
+    const isNvidia = provider === "nvidia" || baseUrl.includes("integrate.api.nvidia.com");
+    const isAntLing = provider === "ant-ling" || baseUrl.includes("api.ant-ling.com");


+    const isNvidia = provider === "nvidia" || baseUrl.includes("integrate.api.nvidia.com");
+    const isAntLing = provider === "ant-ling" || baseUrl.includes("api.ant-ling.com");
+    const isCerebras = provider === "cerebras" || baseUrl.includes("cerebras.ai");
+    const isDeepSeek = provider === "deepseek" || baseUrl.toLowerCase().includes("deepseek.com");


cursor

Stale Bugbot comment from a previous run.

git describe --tags prefers the annotated v0 over the lightweight vX.Y.Z on the same commit, so Craft would read v0 as the previous release. Put v0 on a same-tree child commit that main does not reach.

Pointing v0 at the release commit lets git describe return v0 once main reaches that commit, and Craft then cannot parse the latest version. Point v0 at a child commit with the release tree instead, the same fix as getsentry/warden#567.

On same-repo PRs, rebuild dist/action and push it to the PR branch with a release bot app token, so CI runs again on the new commit. The token is created after the build. Fork PRs can't be pushed to, so the existing freshness check stays as the gate there and on main and release branches. Co-Authored-By: BYK <126780+BYK@users.noreply.github.com>

Dependabot runs get no Actions secrets, so the app token step would fail. The ci.yml freshness check stays the gate there. Also note why the github target does not use Craft floatingTags. Co-Authored-By: BYK <126780+BYK@users.noreply.github.com>

cursor

Stale Bugbot comment from a previous run.

Build the bundle in a job with no secrets and pass it on as an artifact. A second job creates the app token, commits the artifact and pushes it, with no install, no build and git hooks off for both commit and push.

@BYK

…kup (#969) Fixes two `floatingTags` bugs that keep repos with `v`-prefixed release tags from using it. **Prereleases moved floating tags.** `updateFloatingTags` had no prerelease check, so a `pre` release like `0.54.0-alpha.0` moved `v0` to the alpha for everyone pinned to `@v0`. It now skips (and logs) when the version has a semver prerelease identifier. **Floating tags hid the previous release.** `git describe --tags --match 'v*'` also matches `v0`. When `v0` and `v0.53.0` are on the same commit, git picks `v0`, Craft can't parse a version from it, and `auto` computes from `0.0.0` (a vitest-evals dry run gave `0.0.0 -> 0.1.0`). `findLatestTag` now skips tags with no version after the prefix (`v0`, `v0.53`, `latest`) by excluding them and describing again, the same loop it already used to skip prereleases. `getLatestTag` goes through it too, so `prepare`, auto/pre versioning, the changelog base, and `craft changelog` all get the fix. Prefixed monorepo tags and prerelease handling are unchanged. Tests cover a prerelease leaving floating tags alone, a stable release still moving them, and a real git repo where `v0` and `latest` sit on the `v0.53.0` commit, which now resolves to `v0.53.0` for every lookup. The GitHub target docs mention both behaviors. This unblocks getsentry/warden#567 and getsentry/vitest-evals#117 replacing their `update-major-tag.sh` scripts with `floatingTags: ["v{major}"]`.  via @BYK.    -- [View Session](https://junior-prod.sentry.dev/conversations/agent%3A5177a1a88a2e80b15a376402e26b19da) [[Sentry]](https://sentry.sentry.io/explore/conversations/agent%3A5177a1a88a2e80b15a376402e26b19da/?project=4510944073809921)  --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <126780+BYK@users.noreply.github.com>

Craft 3.11.1 moves floating tags on stable releases only and skips them when it looks up the previous release. Set floatingTags: ['v{major}'] on the github target, require Craft 3.11.1, and remove update-major-tag.yml and bin/update-major-tag.sh. Co-Authored-By: BYK <126780+BYK@users.noreply.github.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 62844ca. Configure here.}

sentry-junior Bot assigned BYK Nov 6, 2026

BYK requested changes Nov 6, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Resolved

cursor Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Resolved

ci(release): Use floating getsentry/craft@v3 tag

85ffac6

vercel Bot deployed to Preview – warden November 6, 2026 13:06

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:07

View deployment

vercel Bot deployed to Preview – warden November 6, 2026 13:08

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:08

View deployment

sentry-warden Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Resolved

vercel Bot deployed to Preview – warden November 6, 2026 13:18

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:18

View deployment

sentry-junior Bot and others added 3 commits November 6, 2026 13:18

build(action): Commit the ncc action bundle (part 2)

d1e7234

Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

build(action): Commit the ncc action bundle (part 3)

fd376e3

Co-Authored-By: Burak Yigit Kaya <126780+BYK@users.noreply.github.com>

vercel Bot deployed to Preview – warden November 6, 2026 13:19

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:19

View deployment

github-advanced-security Bot found potential problems Nov 6, 2026

View reviewed changes

cursor Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread bin/update-major-tag.sh Resolved

fix(release): Keep the major tag off the release commit

d5cfa4f

git describe --tags prefers the annotated v0 over the lightweight vX.Y.Z on the same commit, so Craft would read v0 as the previous release. Put v0 on a same-tree child commit that main does not reach.

vercel Bot deployed to Preview – warden November 6, 2026 13:27

View deployment

BYK requested changes Nov 6, 2026

View reviewed changes

Comment thread bin/check-action-dist.sh Resolved

Comment thread bin/update-major-tag.sh Resolved

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:28

View deployment

sentry-junior Bot mentioned this pull request Nov 6, 2026

ci(release): Move to Craft auto versioning getsentry/vitest-evals#117

Open

vercel Bot deployed to Preview – warden November 6, 2026 13:32

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:32

View deployment

vercel Bot deployed to Preview – warden November 6, 2026 13:35

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:35

View deployment

sentry-warden Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread .github/workflows/action-dist.yml Resolved

cursor Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread bin/commit-action-dist.sh Resolved

ci(action): Keep the release bot token out of the PR build job

04f3f12

Build the bundle in a job with no secrets and pass it on as an artifact. A second job creates the app token, commits the artifact and pushes it, with no install, no build and git hooks off for both commit and push.

vercel Bot deployed to Preview – warden November 6, 2026 13:42

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 13:42

View deployment

sentry-junior Bot mentioned this pull request Nov 6, 2026

fix(github): Skip prereleases and ignore floating tags in version lookup getsentry/craft#969

Merged

vercel Bot deployed to Preview – warden November 6, 2026 14:50

View deployment

vercel Bot deployed to Preview – warden-prod November 6, 2026 14:50

View deployment

cursor Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread .craft.yml Resolved

Navigation Menu

Repository navigation

ci(release): Move to Craft auto versioning - #567

ci(release): Move to Craft auto versioning#567
sentry-junior[bot] wants to merge 12 commits into
mainfrom
ci/release-craft-auto-versioning

sentry-junior Bot commented Nov 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

vercel Bot commented Nov 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sentry-junior Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Why the old flow existed

First release after merge

Verification

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vercel Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sentry-junior Bot commented Nov 6, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

vercel Bot commented Nov 6, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading