From 8f6da3182c55f2f580995ca6bd59df2630f49f33 Mon Sep 17 00:00:00 2001 From: Igor Dobryn Date: Mon, 9 Nov 2026 17:11:36 +0200 Subject: [PATCH 1/4] Define draft-release --- .github/workflows/release.yml | 151 ++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..8eb2c24 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,151 @@ +# Publishes the release drafted by draft-release.yml. Runs when the release PR lands on main +# (or manually, as a fallback / dry run): detects the pending draft from CHANGELOG.md, tests and +# builds the gem without any publishing rights, then pushes the built gem to RubyGems from the +# `release` environment and un-drafts the GitHub Release, which creates the tag. +name: Release +on: + push: + branches: [main] + paths: [CHANGELOG.md] + workflow_dispatch: + inputs: + dry_run: + description: "Dry run: detect the release, test and build the gem, but do not publish" + required: false + type: boolean + default: false + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +permissions: + contents: read + +jobs: + detect: + name: Detect pending release + runs-on: ubuntu-latest + outputs: + version: ${{ steps.pending.outputs.version }} + tag: ${{ steps.pending.outputs.tag }} + go: ${{ steps.decide.outputs.go }} + steps: + - name: Refuse to release from a non-default branch + env: + REF: ${{ github.ref_name }} + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + run: | + if [ "$REF" != "$DEFAULT_BRANCH" ]; then + echo "::error::Releases must run from $DEFAULT_BRANCH, got $REF" + exit 1 + fi + + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Resolve pending release + id: pending + uses: railsware/github-actions/resolve-pending-release@master + + # push: skip quietly when nothing is pending (an ordinary CHANGELOG edit). + # dispatch: a real run needs a pending draft; a dry run doesn't. + - name: Decide + id: decide + env: + EVENT: ${{ github.event_name }} + PENDING: ${{ steps.pending.outputs.pending }} + DRY_RUN: ${{ inputs.dry_run }} + run: | + if [ "$PENDING" = "true" ] || [ "$DRY_RUN" = "true" ]; then + echo "go=true" >> "$GITHUB_OUTPUT" + elif [ "$EVENT" = "workflow_dispatch" ]; then + echo "::error::No draft release for the top CHANGELOG.md version; run Draft ruby Release first" + exit 1 + else + echo "Nothing to release" + echo "go=false" >> "$GITHUB_OUTPUT" + fi + + build: + name: Test and build + needs: detect + if: needs.detect.outputs.go == 'true' + runs-on: ubuntu-latest + steps: + # The gemspec lists files with `git ls-files`, so the checkout keeps its .git directory. + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0 + with: + ruby-version: '3.3' + bundler-cache: false + + - name: Check version file matches CHANGELOG.md + env: + EXPECTED: ${{ needs.detect.outputs.version }} + run: | + actual=$(ruby -r ./lib/mailtrap/version.rb -e 'puts Mailtrap::VERSION') + if [ "$actual" != "$EXPECTED" ]; then + echo "::error::Mailtrap::VERSION is $actual but CHANGELOG.md is $EXPECTED" + exit 1 + fi + + - name: Install, test, build + run: | + bundle install + bundle exec rspec + gem build mailtrap.gemspec + mkdir dist && mv mailtrap-*.gem dist/ + + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: gem + path: dist/ + if-no-files-found: error + + release: + name: Publish + needs: [detect, build] + if: ${{ !inputs.dry_run }} + runs-on: ubuntu-latest + environment: release + permissions: + contents: write # edit and un-draft the release + id-token: write # RubyGems trusted publishing + steps: + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: gem + path: dist/ + + - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0 + with: + ruby-version: '3.3' + bundler: none + + - name: Check RubyGems release + uses: railsware/github-actions/check-sdk-rubygems-release@master + with: + gem: mailtrap + version: ${{ needs.detect.outputs.version }} + + - name: Check GitHub release + uses: railsware/github-actions/check-sdk-github-release@master + with: + tag: ${{ needs.detect.outputs.tag }} + + - uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0 + + # Pushing the built gem runs none of its code, so nothing from the dependency tree runs here. + - name: Publish to RubyGems + run: gem push dist/*.gem + + - name: Publish GitHub release + uses: railsware/github-actions/publish-github-release@master + with: + tag: ${{ needs.detect.outputs.tag }} + target: ${{ github.sha }} From 289b2b3a3d5ca4c6896049316e66a863fa7740e6 Mon Sep 17 00:00:00 2001 From: Igor Dobryn Date: Wed, 11 Nov 2026 15:21:01 +0200 Subject: [PATCH 2/4] Treat an unreleased CHANGELOG version as pending detect runs with a read-only token, which can't see draft releases, so resolve-pending-release now reports the newest CHANGELOG.md version as pending until it has a published release. A real dispatch on a version that is already released fails; the publish job's draft check confirms the draft after approval. --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8eb2c24..504c323 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,8 @@ jobs: uses: railsware/github-actions/resolve-pending-release@master # push: skip quietly when nothing is pending (an ordinary CHANGELOG edit). - # dispatch: a real run needs a pending draft; a dry run doesn't. + # dispatch: a real run needs an unreleased version; a dry run doesn't. detect can't see drafts + # (read-only token), so the publish job confirms the draft after approval. - name: Decide id: decide env: @@ -61,7 +62,7 @@ jobs: if [ "$PENDING" = "true" ] || [ "$DRY_RUN" = "true" ]; then echo "go=true" >> "$GITHUB_OUTPUT" elif [ "$EVENT" = "workflow_dispatch" ]; then - echo "::error::No draft release for the top CHANGELOG.md version; run Draft ruby Release first" + echo "::error::The top CHANGELOG.md version is already released; run Draft ruby Release first" exit 1 else echo "Nothing to release" From 94ded912018810753b0ecc29f621582efc589561 Mon Sep 17 00:00:00 2001 From: Igor Dobryn Date: Wed, 11 Nov 2026 16:00:24 +0200 Subject: [PATCH 3/4] Check the full ref in the default-branch guard github.ref_name is the short name, so a manual run started from a tag named like the default branch passed the check and would build that tag's commit. Comparing github.ref with refs/heads/ accepts only the branch. --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 504c323..0ff8a7e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,10 +33,10 @@ jobs: steps: - name: Refuse to release from a non-default branch env: - REF: ${{ github.ref_name }} + REF: ${{ github.ref }} DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} run: | - if [ "$REF" != "$DEFAULT_BRANCH" ]; then + if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then echo "::error::Releases must run from $DEFAULT_BRANCH, got $REF" exit 1 fi From f545410586df0dd0a60450711eef1955cf11a3a5 Mon Sep 17 00:00:00 2001 From: Igor Dobryn Date: Wed, 11 Nov 2026 16:09:05 +0200 Subject: [PATCH 4/4] Log what detect decided and warn on a blind dry run A dry run continues whether or not the top CHANGELOG.md version is released, so it passed even when detection was wrong. Decide now logs pending and dry_run, and a dry run on an already released version gets a warning that it didn't exercise detection. --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0ff8a7e..82f8972 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -59,6 +59,10 @@ jobs: PENDING: ${{ steps.pending.outputs.pending }} DRY_RUN: ${{ inputs.dry_run }} run: | + echo "pending=$PENDING dry_run=$DRY_RUN" + if [ "$DRY_RUN" = "true" ] && [ "$PENDING" != "true" ]; then + echo "::warning::The top CHANGELOG.md version is already released, so this dry run doesn't exercise detection" + fi if [ "$PENDING" = "true" ] || [ "$DRY_RUN" = "true" ]; then echo "go=true" >> "$GITHUB_OUTPUT" elif [ "$EVENT" = "workflow_dispatch" ]; then