From 138e158a46648cdf90cfd2388e5aa77f60c72bd9 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:18:49 +0300 Subject: [PATCH 1/4] Dispatch verification for published releases --- .github/workflows/publish-release.yml | 14 ++++++++++++++ .github/workflows/release.yml | 8 +++++++- .rabbit/repo.yaml | 8 ++++++-- docs/releasing.md | 4 +++- 4 files changed, 30 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 3d329a5..92d2ed3 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -6,6 +6,7 @@ on: - production permissions: + actions: write contents: write concurrency: @@ -104,6 +105,19 @@ jobs: --title "Rabbit Automation Action $RELEASE_TAG" \ --notes-file "$RELEASE_NOTES" + - name: Start release verification + if: steps.release.outputs.publish == 'true' + env: + GH_TOKEN: ${{ github.token }} + RELEASE_TAG: ${{ steps.release.outputs.tag }} + shell: bash + run: | + set -euo pipefail + gh workflow run release.yml \ + --repo "$GITHUB_REPOSITORY" \ + --ref "$GITHUB_REF_NAME" \ + -f release_tag="$RELEASE_TAG" + - name: Notify Rabbit support if: steps.release.outputs.publish == 'true' env: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fb2799f..bee3c51 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,12 @@ on: release: types: - published + workflow_dispatch: + inputs: + release_tag: + description: Published semantic tag to verify + required: true + type: string permissions: contents: read @@ -16,7 +22,7 @@ jobs: - name: Validate semantic release tag shell: bash env: - RELEASE_TAG: ${{ github.event.release.tag_name }} + RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }} run: | set -euo pipefail if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then diff --git a/.rabbit/repo.yaml b/.rabbit/repo.yaml index 7eaf372..c2cd604 100644 --- a/.rabbit/repo.yaml +++ b/.rabbit/repo.yaml @@ -9,8 +9,6 @@ branches: rules: {} - name: chore/publish-versioned-releases rules: {} - - name: dependabot/github_actions/actions/upload-artifact-7 - rules: {} - name: fix/gcp-credential-mount rules: {} - name: infra-templates @@ -78,11 +76,17 @@ workflows: branches: - production permissions: + actions: write contents: write - path: .github/workflows/release.yml triggers: release: types: - published + workflow_dispatch: + inputs: + release_tag: + required: true + type: string permissions: contents: read diff --git a/docs/releasing.md b/docs/releasing.md index 7f52a47..3c09978 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -15,7 +15,9 @@ The action is released from `production`. Patch releases are immutable The `Publish release` workflow runs after every `production` push. It does nothing unless that push changes the `package.json` version; then it runs `make test`, refuses to reuse an existing tag, and publishes that GitHub -release from the merged commit. The `Verify release` workflow then validates the published tag. +release from the merged commit. It explicitly dispatches `Verify release` for +the published tag, because release events created with `GITHUB_TOKEN` do not +start other workflows. After the GitHub release is created, `#rabbit-support` receives the Marketplace handoff through `SLACK_WEBHOOK_RABBIT_SUPPORT`; the message directs the operator to wait for verification before publishing to Marketplace. From a3959d518b076ba85790783eebbf83dfea5fd881 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:21:16 +0300 Subject: [PATCH 2/4] Format release notification for Slack --- .github/workflows/publish-release.yml | 2 +- .rabbit/repo.yaml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 92d2ed3..5c9594e 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -130,7 +130,7 @@ jobs: payload="$(jq -nc \ --arg tag "$RELEASE_TAG" \ --arg url "$RELEASE_URL" \ - '{text: ("Rabbit Automation Action " + $tag + " is published. Marketplace action: open " + $url + ", wait for Verify release to pass, then publish to the GitHub Marketplace. Verify the listing and complete the caller canary before moving v1.")}')" + '{text: (":rocket: Rabbit Automation Action *" + $tag + "* is published.\n" + $url + "\n\nNext:\n• Wait for *Verify release* to pass.\n• Publish it in GitHub Marketplace (Deployment, Security).\n• Verify the listing and complete the caller canary before moving `v1`.")}')" curl --fail-with-body --silent --show-error \ --request POST \ --header 'Content-type: application/json' \ diff --git a/.rabbit/repo.yaml b/.rabbit/repo.yaml index c2cd604..6118844 100644 --- a/.rabbit/repo.yaml +++ b/.rabbit/repo.yaml @@ -9,6 +9,8 @@ branches: rules: {} - name: chore/publish-versioned-releases rules: {} + - name: fix/dispatch-release-verification + rules: {} - name: fix/gcp-credential-mount rules: {} - name: infra-templates From 5afbcb68f79ee159da4727674876b1af42673f98 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:21:59 +0300 Subject: [PATCH 3/4] Verify the dispatched release tag --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bee3c51..5b753e9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: - name: Checkout release uses: actions/checkout@v7 with: - ref: ${{ github.event.release.tag_name }} + ref: ${{ github.event.release.tag_name || inputs.release_tag }} - name: Install yq shell: bash From b70ec360c0a1b8c3dd9b794a5fc7fff559d3b8c5 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:23:43 +0300 Subject: [PATCH 4/4] Add DevOps code ownership --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..b01179e --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @udx/devops