Repository navigation
Conversation
Disabled until MONTHLY_PATCH_ENABLED is true. Worker accepts only authorized controller dispatch; shared files copied from the notation CLI draft. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 54584d0b-0708-4ee3-8fd9-cc529e25eac4
There was a problem hiding this comment.
🟡 Changes recommended
Publication artifact paths, stable-branch CI coverage, and worker credential identity enforcement have blocking defects.
3 open findings
What changed in this PR
Adds disabled-by-default monthly patch release automation for Core, coordinated by the notation CLI controller.
Changes:
- Adds release preparation, qualification, packaging, publishing, and verification workflows.
- Adds authorization, voting, propagation, asset-validation helpers, and regression tests.
- Documents required repository setup and activation.
| File | Description |
|---|---|
.github/workflows/monthly-patch-release.yml |
Defines the coordinated release worker. |
.github/workflows/notation-release-validation.yml |
Validates automation and tests. |
.github/scripts/monthly_release.py |
Implements release lifecycle orchestration. |
.github/scripts/notation_release_controller.py |
Validates controller authorization. |
.github/scripts/monthly_release_pr.py |
Manages release backport PRs. |
.github/scripts/monthly_release_vote.py |
Validates release voting. |
.github/scripts/monthly_release_checks.py |
Implements source and asset gates. |
.github/scripts/notation_fork_propagation.py |
Handles fork dependency propagation. |
.github/scripts/qualify_monthly_candidate.py |
Qualifies source candidates. |
.github/scripts/build_monthly_assets.py |
Builds and validates release assets. |
.github/scripts/test_monthly_public_release.py |
Verifies published artifacts. |
.github/scripts/monthly_cli_smoke.py |
Runs packaged CLI smoke checks. |
.github/scripts/check_notation_fork_setup.py |
Checks fork prerequisites. |
.github/scripts/test_monthly_release.py |
Tests release orchestration. |
.github/scripts/test_monthly_release_pr.py |
Tests release PR handling. |
.github/scripts/test_monthly_release_vote.py |
Tests voting rules. |
.github/scripts/test_monthly_release_checks.py |
Tests release gates. |
.github/scripts/test_notation_release_controller.py |
Tests controller behavior. |
.github/scripts/test_upstream_authorization.py |
Tests canonical authorization. |
.github/scripts/test_notation_fork_release.py |
Tests fork release behavior. |
.github/MONTHLY_PATCH.md |
Documents setup and activation. |
.gitattributes |
Marks generated workflow locks. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| 1. **Actions and issues.** Enable GitHub Actions and Issues for the repository. | ||
| 2. **Dependabot.** Keep Dependabot version updates for `gomod` and `github-actions` enabled on `main` (see `.github/dependabot.yml`). | ||
| 3. **Merge settings.** Allow merge commits. The release flow merges exact reviewed heads with normal merge commits. | ||
| 4. **Release branch.** Maintain the selected latest stable `release-X.Y` branch with a verified signed stable baseline. Protect it and `main` with the required status checks (the `Build`, `CodeQL`, and license checker workflows) and required reviews. Do not grant bypass to the automation identity. |
Comment on lines
+194
to
+197
| for key in ("MONTHLY_PATCH_TOKEN_READY", "MONTHLY_PATCH_SIGNING_KEY", | ||
| "MONTHLY_PATCH_SIGNER_EMAIL", "MONTHLY_PATCH_SIGNER_LOGIN", "MONTHLY_PATCH_ACTOR"): | ||
| if not environment.get(key) or (key.endswith("READY") and environment[key] != "true"): | ||
| raise ValueError(f"Missing execution prerequisite: {key}") |
Comment on lines
+391
to
+394
| - name: Locate publication manifest | ||
| if: needs.publish.result == 'success' | ||
| shell: bash | ||
| run: cp "$RUNNER_TEMP/publication/published/plan.json" "$RUNNER_TEMP/publication/plan.json" |
Core now carries only a thin caller pinned to the shared notation worker (draft pin, must be rebound to the merged upstream SHA) and the setup runbook. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 54584d0b-0708-4ee3-8fd9-cc529e25eac4
Rebind the caller to the frozen shared worker (provisional until the upstream notation PR merges) and document plan approval, draft review, and manual publish. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 54584d0b-0708-4ee3-8fd9-cc529e25eac4
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Pin the shared worker, document concise scope and targeted notifications, and retain disabled stable releases until pre-tag approval exists. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds only
.github/workflows/monthly-patch-release.ymland.github/MONTHLY_PATCH.md: a thin SHA-pinned caller and Core setup guide. All release implementation and tests live in notaryproject/notation#1369. No product source, dependency or ordinary CI changes.Core keeps its own source/artifact gates and branch reviews. It has no dependency on the other two Notation repositories, no separate assessment timer and no Copilot credential. All release automation is disabled when
MONTHLY_PATCH_ENABLEDis unset or false.Maintainer setup
notaryproject/notation/.github/workflows/monthly-patch-worker.yml.main. Maintain the latest stablerelease-MAJOR.MINORbranch, verified signed baseline tag, required checks and reviews. Do not grant bypass.MONTHLY_PATCH_TOKENandMONTHLY_PATCH_SIGNING_KEY. The token must authenticate the commonMONTHLY_PATCH_ACTORuser viaGET /user, with Contents/PR/Issues/Actions write across the three repos and Workflows write if needed for reviewed workflow changes. App installation tokens are unsupported. Register only the public signing key.MONTHLY_PATCH_ACTOR,MONTHLY_PATCH_SIGNER_LOGIN,MONTHLY_PATCH_SIGNER_EMAILand optionalMONTHLY_PATCH_SIGNER_NAME. LeaveMONTHLY_PATCH_ENABLEDfalse/unset until explicit activation approval.Review and publication
Core has one release issue with its month, own current/proposed versions, changes, status, and maintainer action. The CLI overview links it without copying Core's details. An active CLI maintainer approves the overall plan with
/approve; a changed plan requires fresh approval. Core's own checked backport PR remains required.The central assessment separately proposes evidence-backed bug fixes from new
maincommits that apply to the stable line. This stage is read-only and does not authorize backports or expand approved scope automatically. Features remain excluded.The worker stages a true draft and posts a review request to Core's existing release issue only after quality gates pass. A maintainer publishes through GitHub; automation never publishes an official release. Consumers wait for exact release/asset identity and successful anonymous public verification.
Production limitation: the current worker creates the signed tag before draft review. A GitHub draft does not hide tags or prevent Go module downloads. The separate pre-tag maintainer gate is not implemented. Official stable release writes must stay disabled until it is implemented and validated.
Errors and blockers go to Core's release issue with Core maintainer mentions and failed stage/run/evidence links. Dependent issues receive concise blocker links, not copied errors. The same issue receives the draft-ready review request; routine progress does not generate comments. Alerts are deduplicated, and a new failed retry can produce a new alert without changing approved scope. Subscribe to Core's issue and configure GitHub notifications; email delivery is not guaranteed. Actions failures/logs are the fallback.
Companion and pin requirement
The current reviewed worker pin is
953678d7760d177da9e3f4f61e928df8427eee24in bothusesandworker_sha. It is provisional: merge the CLI PR first, then replace both pins with its final upstream merged SHA before merging or activating Core. Unmerged revisions cannot authorize execution.The caller passed actionlint and exact-pin/two-file scope checks. Shared release and canonical authorization regressions live in the CLI repository and are not copied here. No live upstream Core release or credential setup was performed. Repository settings, secrets, release execution, and activation remain separate maintainer actions.