You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Composite action for the k8s-* repos at actions/flux-update-pr. Flux ImageUpdateAutomation finds the new tag and pushes the bump to a branch; the action turns that branch into a PR that operators can judge without leaving GitHub.
Reads the changed $imagepolicy setters from the branch diff against main.
Lists the upstream release notes for every release between the old and new version.
Pulls the releases' deploy / upgrade / migration / behavior-change sections into a Before merging block at the top, and warns when notes announce a breaking change.
Assignees, reviewers and labels are configured per component in .github/flux-updates.yaml of the calling repo.
Supports charts whose changelog follows appVersion (version: appVersion + chart:), e.g. the NATS case in k8s-opstrom.
Only rewrites the body between its markers, so human notes on the PR survive later Flux pushes.
Optional summarize: the Copilot CLI writes a verdict and action items per component, authenticated with the workflow token (copilot-requests: write) and billed to the org. It replaces the Before merging section, which stays the fallback when summarizing is off or fails. The CLI runs with no tools allowed, in an empty directory, without custom instructions or MCP servers.
@mentions in quoted release notes and in the summary are defanged, so these PRs don't notify upstream contributors.
Layout: action.yml runs actions/github-script on index.js (GitHub API, git, helm); the logic that decides what goes in the PR is in lib.js as pure functions with node:test tests, run by .github/workflows/test-actions.yaml. No build step or dist/. Docs: actions/flux-update-pr/README.md.
Test plan
node --test 'actions/**/*.test.js' (19 tests: diff parsing, tag extraction, component matching, release selection and SemVer precedence, upstream tag resolution, deploy-section extraction incl. code fences, body merge, titles, body size budget, summary input/sanitizing/rendering, mention defanging)
Local dry run of index.js against a simulated Flux branch (create and no-op)
End to end in k8s-cloud-backend on throwaway branches: pinax-network/k8s-cloud-backend#199 was created with the release notes, the Before merging section and fschoell assigned. A note added to the body survived a re-push and the title followed the new version. PAT_INTERNAL_REPOSITORIES reads the private release notes. Closed, branches deleted.
Summarize end to end: pinax-network/k8s-cloud-backend#201 got a Copilot CLI summary (verdict Needs config or secret change, 5 action items, each checked against the release notes and citing the right release). Fallback tested locally for CLI error, CLI missing and summarize off. Closed, branches deleted.
Turns a Flux ImageUpdateAutomation push branch into a PR carrying the
upstream release notes, a Before merging section built from their
deploy/upgrade notes, and per-component assignees and reviewers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The logic moves out of an inline github-script string into index.js
(GitHub API, git, helm) and lib.js (pure functions) with node:test unit
tests and a CI workflow. Callers now own their trigger, checkout,
permissions and concurrency, and get the PR number and URL as outputs.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fschoell
changed the title
Add flux-update-pr reusable workflow
Add flux-update-pr action
Oct 6, 2026
- Budget the whole PR body: deploy notes and release bodies expand while
they fit (deploy notes first) and fall back to links; the limit leaves
room for text people wrote around the managed block.
- Read every release page; the API lists by creation date, so a
backport can follow any number of newer releases.
- Build compare links from the upstream tags that exist, so appVersions
without a v prefix don't link to missing refs.
- Order prereleases by SemVer rules (numeric identifiers first).
- Ignore # lines inside fenced code blocks when extracting sections.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With summarize: true, the release notes go to GitHub Models and its
verdict and action items replace the Before merging section. That
section remains the fallback when summarizing is off, the call fails,
or the notes are too long, so the body holds one or the other.
Mentions in model output and quoted release notes are defanged so the
PRs don't notify upstream contributors.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
GitHub Models was retired on 2026-07-30. The summary now comes from the
Copilot CLI, authenticated with the workflow token through the
copilot-requests: write permission and billed to the organization.
The CLI runs non-interactively with no tool pre-approved, in an empty
directory, without custom instructions or built-in MCP servers. Any
failure, including a missing CLI or a disabled org policy, falls back
to the Before merging section.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sanitize release markers and mentions in deployment headings
actions/flux-update-pr/lib.js:278
Sanitize all quoted release content, including deployment headings and excerpts. Embedded <!-- flux-update-pr:end --> markers currently make the next mergeBody refresh stop early, preserving stale release or deployment instructions as human notes and accumulating them on later pushes. Deployment headings also bypass noMentions, so ## Deploy notes for @ops-team remains a live mention in both expanded and shortened excerpts. Strip both reserved markers from headings, excerpts and full bodies, and defang heading mentions. Add regression tests for repeated refreshes and mentions in headings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fschoell
changed the title
Summary
Composite action for the k8s-* repos at
actions/flux-update-pr. FluxImageUpdateAutomationfinds the new tag and pushes the bump to a branch; the action turns that branch into a PR that operators can judge without leaving GitHub.$imagepolicysetters from the branch diff againstmain..github/flux-updates.yamlof the calling repo.appVersion(version: appVersion+chart:), e.g. the NATS case in k8s-opstrom.summarize: the Copilot CLI writes a verdict and action items per component, authenticated with the workflow token (copilot-requests: write) and billed to the org. It replaces the Before merging section, which stays the fallback when summarizing is off or fails. The CLI runs with no tools allowed, in an empty directory, without custom instructions or MCP servers.Layout:
action.ymlrunsactions/github-scriptonindex.js(GitHub API, git, helm); the logic that decides what goes in the PR is inlib.jsas pure functions withnode:testtests, run by.github/workflows/test-actions.yaml. No build step ordist/. Docs:actions/flux-update-pr/README.md.Test plan
node --test 'actions/**/*.test.js'(19 tests: diff parsing, tag extraction, component matching, release selection and SemVer precedence, upstream tag resolution, deploy-section extraction incl. code fences, body merge, titles, body size budget, summary input/sanitizing/rendering, mention defanging)Local dry run of
index.jsagainst a simulated Flux branch (create and no-op)End to end in k8s-cloud-backend on throwaway branches: pinax-network/k8s-cloud-backend#199 was created with the release notes, the Before merging section and fschoell assigned. A note added to the body survived a re-push and the title followed the new version.
PAT_INTERNAL_REPOSITORIESreads the private release notes. Closed, branches deleted.Summarize end to end: pinax-network/k8s-cloud-backend#201 got a Copilot CLI summary (verdict
Needs config or secret change, 5 action items, each checked against the release notes and citing the right release). Fallback tested locally for CLI error, CLI missing and summarize off. Closed, branches deleted.