UID2-7445: automate shared-actions releases (dispatch-only)#256
Merged
Conversation
Add publish-shared-actions.yaml: dispatch-only, main-pinned via the release environment, cutting the release and moving the major-version tag as UID2SourceAdmin. Add a github_token input to update-major-version-tag so the move can run under that PAT (defaults to GITHUB_TOKEN, backward compatible). Remove the release-triggered update-major-version-tags.yaml, now folded into the new workflow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
update-major-version-tag's regex requires a leading 'v'; the move step was passing the bare number (3.99), which silently no-op'd the v3 move. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mikepenz tag auto-detection mis-sorts shared-actions' non-sequential tags (v3.7 vs v3.70); resolve the previous published release explicitly so a release batching several merges gets an accurate changelog. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
shared-actions ships no installable artifact, so mikepenz's per-platform install templating brings no value here. Built-in generate_release_notes matches the repo's historical UI-created notes format, drops a third-party action from the release path, and sidesteps mikepenz's semver tag filter (our v3.x tags are two-component, not valid semver). Removes the mikepenz and resolve-previous-tag steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
swibi-ttd
commented
Jul 13, 2026
swibi-ttd
left a comment
swibi-ttd
left a comment
Contributor
Author
There was a problem hiding this comment.
Adversarial self-review (6 critics + defender pass, 90 raised → 13 sustained). Inline comments below cover the code-anchored findings. Ticket-level items with no code anchor:
- AC2 evidence: neither PR links a successful end-to-end dispatch run of this workflow. That run also exercises the ruleset-bypass direction and the composite action's new token branch — sequence it before the ruleset activates (see okta-configuration PR #232 rollout comment).
- AC1 scope: this covers 1 of 4 ticket-named repos; uid2-operator (release assets feed prod directly) is untouched. Needs tracked follow-up tickets, and the PR body's "closing the tag/release path" claim should be scoped to shared-actions.
- AC3: residual gaps (repo-admin ruleset editability, fleet-PAT reach, releases-on-existing-tags for operator) need explicit handoff to UID2-7428 before ticket closure.
- AC4: Confluence "How to Build and Deploy" update not yet evidenced — doubly needed since the UI release path's behavior changes for all admins.
- correct the header: the v* ruleset is bypassed by release automation AND uid-admins (JITA), not the PAT alone - add a concurrency group so two dispatches can't race the version compute - record why we use built-in notes over the canonical shared_create_releases Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Same behaviour as the string form, but spells out that a release must never be cancelled mid-flight (partial tag/release state). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The tag exists before the release step (created via github-script under the PAT), so creating the release needs only contents: write — use the ephemeral GITHUB_TOKEN there and confine the PAT to the two first-party tag-write steps. Avoids handing the fleet's most powerful credential to a third-party action. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Previously a version not matching vMAJOR.MINOR logged and exited 0, silently skipping the major-tag move. Since v3 feeds ~200 @V3 consumers, make it core.setFailed instead — closes the silent path at the source for all callers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the two near-identical seds with param expansion (fewer moving parts, no drift between major/minor extraction) and fail loud if no vMAJOR.MINOR tag exists instead of silently producing v.1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Under -eo pipefail a no-match grep fails the assignment and errexit ends the step before the guard could run — so the guard was dead. errexit already prevents a silent v.1; document that instead of keeping dead code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
BehnamMozafari
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automates uid2-shared-actions releases so they can only come from reviewed (main) code — closing the tag/release path in UID2-7445. Pairs with the tag ruleset in UnifiedID2/uid2-okta-configuration#232.
publish-shared-actions.yaml(new): dispatch-only, runs in thereleaseenvironment (main-pinned, holds the UID2SourceAdmin PAT). Computes next version, creates the tag + release, moves the major-version tag — all as UID2SourceAdmin. Replaces manual UI releases.update-major-version-tag: optionalgithub_tokeninput so the move can run under the PAT (defaults toGITHUB_TOKEN— backward compatible; used only by this repo).update-major-version-tags.yaml: the release-triggered mover, now folded into the new workflow.🤖 Generated with Claude Code