chore: add auto-release workflows for .github repo #28
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add workflows to enable Type A (single public repo) release automation: - auto-release-on-pr.yml: Creates tag when PR with auto-release label merges - auto-release.yml: Creates GitHub Release when tag is pushed Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
Walkthrough新增两个 GitHub Actions 工作流：在合并带 Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor 开发者
participant GitHub
participant Workflow_PR as "auto-release-on-pr\n工作流"
participant Git操作
participant Workflow_Tag as "auto-release\n工作流"
participant AutoReleaseAction as "Auto Release\nAction"
participant Feishu
开发者->>GitHub: 合并带 `auto-release` 标签的 PR（源分支 release/*）
GitHub->>Workflow_PR: 触发（PR 已关闭且已合并）
Workflow_PR->>Workflow_PR: 提取版本、校验语义版本、检查远端标签
Workflow_PR->>Git操作: 创建注释标签并推送到 origin
Git操作-->>GitHub: 标签已推送
GitHub->>Workflow_Tag: 检测到 `v*` 标签推送并触发工作流
Workflow_Tag->>AutoReleaseAction: 调用 auto-release action（传入 token、prerelease、feishu-webhook）
AutoReleaseAction->>GitHub: 创建 GitHub Release（基于标签）
AutoReleaseAction->>Feishu: 发送发布通知到 Feishu webhook
Feishu-->>开发者: 发送发布通知
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Tip 🧪 Unit Test Generation v2 is now available!We have significantly improved our unit test generation capabilities. To enable: Add this to your reviews:
finishing_touches:
unit_tests:
enabled: trueTry it out by using the Have feedback? Share your thoughts on our Discord thread! Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/workflows/auto-release-on-pr.yml:
- Around line 25-44: The tag existence check in the "Extract version and create
tag" step uses git rev-parse which only inspects local refs (and
actions/checkout defaults prevent tags being fetched), so the check is
ineffective; update that step to query the remote instead (for example by
replacing the git rev-parse check with a remote query such as using git
ls-remote --tags --exit-code against origin for the VERSION or alternatively
enable fetching tags in the Checkout step) so the workflow reliably detects
existing remote tags before attempting to push.
In @.github/workflows/auto-release.yml:
- Around line 20-21: Replace the floating ref to the composite action by pinning
the uses declaration to a full commit SHA: locate the line using "uses:
wuji-technology/.github/actions/auto-release@main" and change it to "uses:
wuji-technology/.github/actions/auto-release@<full-commit-sha>"; update the SHA
to the exact commit you’ve vetted (not a branch or tag), commit that change, and
document the chosen SHA in the PR so reviewers can verify the pinned revision.
- Use git ls-remote to check remote tags instead of git rev-parse (local check fails because checkout@v4 doesn't fetch tags by default) - Pin auto-release action to full commit SHA for supply chain security Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/auto-release-on-pr.yml:
- Around line 25-50: The workflow currently tags whatever was checked out (the
PR merge ref) which may not match main; update the Checkout and tagging steps to
use the PR's merge commit SHA: use github.event.pull_request.merge_commit_sha as
the ref when checking out (replace the current actions/checkout usage of the PR
ref/branch), and when creating the tag ensure you tag that exact SHA (use
VERSION and the merge_commit_sha as the target for git tag and git push) so the
annotated tag is created on the real merge commit rather than the transient
refs/pull/*/merge ref.
🧹 Nitpick comments (2)
.github/workflows/auto-release.yml (1)
17-18: 将 actions/checkout 固定到完整 SHA 以增强供应链安全使用版本标签（如
@v4）存在供应链风险，版本标签可能被移动或重新标记。GitHub 官方推荐将第三方 action 固定到完整的提交 SHA（40 个字符），并通过注释记录版本号便于维护和更新。注意到当前工作流中的自定义 action 已正确固定到 SHA，建议对actions/checkout采用同样的做法保持一致性。🔧 建议修改
- name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.github/workflows/auto-release-on-pr.yml (1)
18-28: 建议将第三方 Action 固定到完整 SHA 以降低供应链风险
actions/create-github-app-token@v2与actions/checkout@v4目前使用版本标签，建议固定到完整提交 SHA，并在注释里标明版本号。🔧 建议修改
- name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2 with: app-id: ${{ vars.AUTOMATION_APP_ID }} private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: token: ${{ steps.app-token.outputs.token }}
mookechee
previously approved these changes
Jan 29, 2026
- auto-release-on-pr.yml: checkout and tag the actual merge commit (merge_commit_sha) instead of the temporary PR merge ref, ensuring the tag always points to a real commit on main regardless of merge strategy (squash/rebase/merge) - parse-repos.py: allow dot in repo names so .github repo can be released via centralized-release workflow Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
ThirteenLLB
requested review from
chenjunnn and
mookechee
and removed request for
chenjunnn
ThirteenLLB
requested review from
JiangCiT-T
and removed request for
JiangCiT-T
chenjunnn
requested changes
Jan 30, 2026
Contributor
chenjunnn
left a comment
chenjunnn
left a comment
There was a problem hiding this comment.
PR title 中的 Type A 指代不明
ThirteenLLB
changed the title
chenjunnn
approved these changes
Jan 30, 2026
This was referenced Jan 30, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
auto-release-on-pr.ymlworkflow: creates tag when PR withauto-releaselabel merges fromrelease/v*branchauto-release.ymlworkflow: creates GitHub Release when tag is pushed (using existingauto-releaseaction)This enables Type A (single public repo) release automation for the
.githubrepository itself.Test plan
验证步骤：
release/v1.0.0分支，更新 CHANGELOG 中的[Unreleased]为[1.0.0]auto-release标签前置检查：
AUTOMATION_APP_ID(Variable)AUTOMATION_APP_PRIVATE_KEY(Secret)🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.