ci: add Linear release sync workflow and refresh action pins#749
Closed
chybisov wants to merge 4 commits into
Closed
ci: add Linear release sync workflow and refresh action pins#749chybisov wants to merge 4 commits into
chybisov wants to merge 4 commits into
Conversation
Syncs published npm releases into the Linear "Widget" release pipeline. Runs after "Release & Publish Beta" succeeds (workflow_run gated on conclusion == success), so issues are attached only once packages are on npm. Each release runs `sync` to attach merged issues and link the tag; alpha/beta tags advance the stage via `update`, while only the stable tag runs `complete`, which fires Linear's "release completion -> Done" automation.
Addresses review feedback on #749: - Restrict the job to successful runs originating from this repo (head_repository guard) to address the workflow_run privilege- escalation warning; the upstream publish workflow is tag-push/dispatch only, so this can't be triggered by untrusted contributors. - Append `|| true` to tag resolution so a no-tag HEAD (e.g. a workflow_dispatch publish) cleanly skips instead of failing under `set -eo pipefail`. - Add a concurrency group keyed to the release commit. - Rename linear-release.yml -> .yaml to match repo convention.
Split publish.yaml into an orchestrator that composes three single-purpose reusable workflows: github-release, npm-publish, and linear-release. The Linear sync now runs as a `needs: npm-publish` job instead of a separate `workflow_run` workflow, which: - gates precisely on npm publish success (a failed GitHub Release job no longer strands the Linear sync) — fixes the coarse-gating issue - removes the `workflow_run` trigger flagged by Aikido - takes the tag from `github.ref_name` instead of re-discovering it via `git tag --points-at` - replaces the brittle workflow-name coupling with a direct file reference Secrets are scoped per sub-workflow: only Linear receives the pipeline access key; GitHub Release uses the auto GITHUB_TOKEN; npm publish uses OIDC provenance (no token).
2 tasks
Member
Author
|
Folded into #753, which now targets The |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which Linear task is linked to this PR?
Closes EMB-399
Why was it implemented this way?
Adds a new
linear-release.ymlworkflow that feeds our published npm releases into the Linear "Widget" scheduled release pipeline, so issues flowReady for Release → Doneonly when code actually ships to npmlatest.Design choices:
publish.yaml), triggered viaworkflow_runon "Release & Publish Beta" and gated onconclusion == 'success'. This keeps it decoupled from the publish path while guaranteeing it only runs after packages are 100% on npm.X.Y.Z: the tag's-alpha.N/-beta.Nsuffix is stripped so every prerelease and the final stable tag roll into a single release that progressesAlpha → Beta → Released. Each prerelease tag is attached as a link.complete), which fires Linear's "On release completion → Done" automation. Alpha/beta onlyupdate --stage, so tickets stayReady for Releaseuntil the stable ship.git tag --points-at HEAD) becauseworkflow_run.head_branchis unreliable for tag pushes.Also audited every action pin across
.github/and bumped the one that was behind:aws-actions/configure-aws-credentialsv6.1.1 → v6.1.2. All others were already on the latest release SHA.Note
workflow_runonly triggers once this file is onmain. The merge automation + release attach also require EMB PRs to be Linear-linked with a closing magic word and merged via squash/merge-commit (not rebase).Visual showcase (Screenshots or Videos)
N/A — CI-only change.
Checklist before requesting a review