ci(release): migrate release automation to release-please manifest mode - #151
Merged
Merged
Conversation
Replaces the fragile matrix + single-commit git diff/grep hack in release.yml with real release-please manifest mode, backed by a root release-please-config.json/.release-please-manifest.json (one package per Component, path-scoped to <name>/ only). Requires upgrading release-please-action v3 -> v5, since v5 dropped the package-name input the matrix job depended on. Also: - scope scripts/compute-workflow-sha256.sh to only the 8 reusable (workflow_call:) workflow files instead of all 9, and make it executable - add a pull_request-triggered CI check that runs the script with --check on every PR (not wired into branch protection yet) - add CONTRIBUTING.md documenting the workflow-sha256 sync step
Bootstraps <name>/workflow-sha256 for every Component so the new verify-workflow-sha256 PR check (introduced in the prior commit) has something to compare against instead of failing immediately on the first PR.
…ig.json root release-type, bump-patch-for-minor-pre-major, and bump-minor-pre-major were identical across all 8 packages; release-please-config.json applies root-level ReleaserConfigOptions as defaults to every package, so set them once instead of repeating per package.
Locks the separator between component name and version in generated GitHub tags (e.g. docker-build-v3.5.2) so it doesn't silently change if release-please's own default ever changes.
The script isn't executable, so both CI and the documented contributor workflow must invoke it as `bash scripts/compute-workflow-sha256.sh` rather than relying on the shebang and execute permission.
v6.1.0 was picked to match this repo's most common existing pin, but v7.0.1 is actually the latest release and is already used elsewhere in the repo (publish-npm.yml) — align on the current version instead of the majority-but-stale one.
…ha256 This job only reads the repo to compute a checksum and never pushes, so there's no reason for actions/checkout to leave the GITHUB_TOKEN in the local git config for later steps to pick up.
Explicitly requests only the permissions release-please-action needs via create-github-app-token's permission-* inputs, instead of letting the generated installation token inherit the GitHub App's full set of installed permissions.
${{ ... }} is already a valid unquoted YAML plain scalar; the quotes
were leftover from the pre-existing release-please.yml this step was
copied from and don't change parsing here, just inconsistent with the
unquoted private-key line right below it.
Read the tracked workflow names from release-please-config.json's packages keys (via jq) instead of grepping .github/workflows/*.yml for workflow_call: declarations. A reusable workflow with no package entry isn't versioned by release-please, so it has no reason to carry a workflow-sha256 file — scoping to the config's package list ties the check to what's actually tracked instead of what merely looks reusable. jq ships by default on GitHub-hosted ubuntu-latest runners. Document release-please-config.json as the source of truth for this in CONTRIBUTING.md.
PierreJeanjacquot
marked this pull request as ready for review
September 22, 2026 13:57
Keeps open release PRs continuously refreshed with the latest changes instead of staying static after initial creation.
Purely cosmetic — release-please doesn't care about JSON key order — but keeps both files easier to scan and diff as packages are added.
jbern0rd
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the fragile matrix + single-commit git diff/grep hack in release.yml with real release-please manifest mode. Forced together with upgrading release-please-action v3 → v5, since v5 dropped the package-name input the old matrix job depended on.
Changes
release-please-config.json/.release-please-manifest.json(new, root): one package per Component — conventional-commits, docker-build, docker-build-cloud, propose-safe-multisig-tx, publish-npm, release-please, rust-build, stale — path-scoped to / only, manifest seeded from each Component's current version.txt..github/workflows/release.yml: matrix/diff-detection job deleted; single job callsgoogleapis/release-please-action(pinned SHA, v5.0.0) directly, App-token step now scoped to only contents/issues/pull-requests via permission-* inputs instead of inheriting the App's full permission set.scripts/compute-workflow-sha256.sh: discovers which workflows need a checksum by readingrelease-please-config.json's packages keys — ties the check to what release-please actually tracks, so a reusable workflow with no config entry doesn't get a pointless checksum file. Invoked via bash (not made executable)..github/workflows/verify-workflow-sha256.yml(new): pull_request-triggered, runscompute-workflow-sha256.sh --checkunconditionally on every PR.<name>/workflow-sha256(new, all 8 Components): bootstrapped so the new PR check doesn't fail immediately on first use.CONTRIBUTING.md(new): documents that release-please-config.json's package list is the source of truth for which workflows get checksum-tracked, and the run-script-and-commit workflow.Out of scope