Repository navigation
ci: address Copilot feedback on the release workflows - #48
Merged
Merged
Conversation
- Feed apps now trigger on numeric v[0-9]* tags only, like update-edge-app.yml. A single step decides production, and the tag-on-main check keys off that result, so a manual run on a tag such as vrc1 stays on stage instead of deploying all feed apps to production. - Initialize Edge App fails unless run from the default branch. The reusable workflow builds the caller's ref, so a run from a feature branch could otherwise initialize an app from unreleased code. - README release commands use a vYY.MM.N placeholder instead of the already-used v26.10.0 tag.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The change affects production/stage routing and adds a branch safety gate around an external reusable deployment workflow, so its runtime paths and approval behavior require manual validation.
No open issues 🎉
What changed in this PR
This pull request hardens release workflows against unintended production deployments and non-default-branch initialization, while updating the README’s release instructions.
Changes:
- Restricts feed-app production handling to numeric
v[0-9]*tags. - Prevents Edge App initialization from non-default branches.
- Replaces the hard-coded README release version with a CalVer placeholder and tag lookup guidance.
| File | Summary |
|---|---|
README.md |
Documents the placeholder-based release process. Nit: filter the latest-tag lookup to the same v[0-9]* pattern used by the workflows. |
.github/workflows/update-rss-reader-apps.yml |
Aligns feed-app production deployment and tag validation with numeric release tags. |
.github/workflows/initialize-edge-app.yml |
Blocks initialization runs started from non-default branches. |
Review effort: Lite
salmanfarisvp
added a commit
that referenced
this pull request
Nov 5, 2026
ci: address Copilot feedback on the release workflows
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the three Copilot comments on #46 that still apply to
development.update-rss-reader-apps.ymltriggered on everyv*tag and treated each as production, so a tag such asvrc1onmainwould deploy all feed apps to production while the main app ignored it. It now triggers onv[0-9]*, likeupdate-edge-app.yml. One step decides production with the same numeric rule, and the tag-on-main check runs off that result, so a manual run on any other ref stays on stage.main. A guard job now fails the run unless it starts from the default branch, which restores the oldref: mainbehaviour. It fails rather than skips, so a wrong-branch run can't look like a success.v26.10.0; they now use avYY.MM.Nplaceholder and say how to find the latest tag.The other two comments on #46 no longer apply: the reusable
update.yml@v26.10.2reads theSTAGE_EDGE_APP_ID/PRODUCTION_EDGE_APP_IDrepo variables itself (both are set), and #47 added the tag-on-main check.One known limit:
run-namestill labels a manual run on a non-numericvtag as production, because workflow expressions can't match digits. The deploy itself goes to stage.