Repository navigation
Conversation
Install the canonical shared worker, authorization and release-vote helpers, regression tests, and Go setup runbook. Preserve existing release voting, CI, and dependency versions. Activation requires separate maintainer approval and companion CLI setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bcc64f14-49a5-4a09-8b61-fd3ee5500435 Signed-off-by: Yi Zha <107919912+yizha1@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #592 +/- ##
=======================================
Coverage 82.76% 82.76%
=======================================
Files 36 36
Lines 2629 2629
=======================================
Hits 2176 2176
Misses 311 311
Partials 142 142 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
🟡 Changes recommended
The publication artifact is read from a nonexistent nested path, blocking verification and completion.
1 open finding
What changed in this PR
Adds disabled-by-default automation for coordinated monthly Go library patch releases, governed by the companion CLI controller.
Changes:
- Adds release preparation, qualification, voting, publication, and verification tooling.
- Adds authorization, fork-propagation, and regression tests.
- Documents configuration and activation requirements.
| File | Description |
|---|---|
.github/workflows/notation-release-validation.yml |
Validates release automation. |
.github/workflows/monthly-patch-release.yml |
Defines the release worker pipeline. |
.github/scripts/monthly_release.py |
Implements release orchestration. |
.github/scripts/notation_release_controller.py |
Implements controller authorization. |
.github/scripts/monthly_release_checks.py |
Provides source and asset gates. |
.github/scripts/monthly_release_pr.py |
Manages release PRs. |
.github/scripts/monthly_release_vote.py |
Validates maintainer voting. |
.github/scripts/notation_fork_propagation.py |
Creates fork propagation PRs. |
.github/scripts/qualify_monthly_candidate.py |
Qualifies release candidates. |
.github/scripts/build_monthly_assets.py |
Builds and validates assets. |
.github/scripts/test_monthly_public_release.py |
Verifies public releases. |
.github/scripts/monthly_cli_smoke.py |
Provides native CLI smoke checks. |
.github/scripts/check_notation_fork_setup.py |
Checks fork prerequisites. |
.github/scripts/test_monthly_release.py |
Tests release orchestration. |
.github/scripts/test_monthly_release_checks.py |
Tests release gates. |
.github/scripts/test_monthly_release_pr.py |
Tests release PR handling. |
.github/scripts/test_monthly_release_vote.py |
Tests voting rules. |
.github/scripts/test_notation_release_controller.py |
Tests controller behavior. |
.github/scripts/test_notation_fork_release.py |
Tests fork releases. |
.github/scripts/test_upstream_authorization.py |
Tests canonical authorization. |
.github/MONTHLY_PATCH.md |
Documents setup and activation. |
.gitattributes |
Marks generated workflow locks. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Locate publication manifest | ||
| if: needs.publish.result == 'success' | ||
| shell: bash | ||
| run: cp "$RUNNER_TEMP/publication/published/plan.json" "$RUNNER_TEMP/publication/plan.json" |
Replace copied release implementation and tests with a thin full-SHA reusable workflow caller. Preserve Go release voting and disabled setup, and require rebinding the provisional CLI pin to the final upstream implementation before merge or activation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bcc64f14-49a5-4a09-8b61-fd3ee5500435 Signed-off-by: Yi Zha <107919912+yizha1@users.noreply.github.com>
Pin the centralized manual-first worker and document exact plan approval, qualified draft review, maintainer publication, and immutable anonymous public verification. Preserve Go release voting and verified Core dependency adoption. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bcc64f14-49a5-4a09-8b61-fd3ee5500435 Signed-off-by: Yi Zha <107919912+yizha1@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Pin the shared worker, document concise scope and targeted notifications, and retain disabled stable releases until pre-tag approval exists. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds only
.github/workflows/monthly-patch-release.ymland.github/MONTHLY_PATCH.md: a thin SHA-pinned caller and Go setup guide. Shared release code, tests, assessment and coordination live only in notaryproject/notation#1369. No product source, dependency, ordinary CI, license or release-checklist changes.Go can release its own dependency updates. It waits for Core only when Core releases in the same cycle, and must adopt the exact verified Core version through a checked producer PR. Missing propagation remains waiting. There is no Go assessment timer or Copilot token.
Maintainer setup
.github/dependabot.ymlmain; preserve required CI/reviews on the latest stablerelease-MAJOR.MINORbranch and a verified signed stable baseline. No bypass.MONTHLY_PATCH_TOKEN, an authenticated-user token whoseGET /userlogin matches the common actor in all three repos. Scope Contents/PR/Issues/Actions write permissions to those repos and Workflows write if reviewed workflow updates need it. App installation tokens are unsupported.MONTHLY_PATCH_SIGNING_KEY; register only its public key on the signer account.MONTHLY_PATCH_ACTOR,MONTHLY_PATCH_SIGNER_LOGIN,MONTHLY_PATCH_SIGNER_EMAIL, optionalMONTHLY_PATCH_SIGNER_NAME. LeaveMONTHLY_PATCH_ENABLEDunset/false until approved activation.Approval, drafts and failure notifications
Each repository has one release issue with its month, own current/proposed versions, changes, dependency issue links, status, and maintainer action. Go links Core's issue without copying Core's changes; the CLI provides the overall status. An active CLI maintainer approves the overall plan with
/approvebefore execution, and a changed plan requires fresh approval. Automatic settings, issue closure, or manual dispatch cannot approve it. Go retains its separatesigningAgentrelease-voting PR, current-head strict-majority repo-level maintainer approval, and normal merge commit. Dependency/backport PRs retain ordinary CI and reviews.The central assessment separately proposes evidence-backed bug fixes from new
maincommits that apply to the stable line. This stage is read-only and does not authorize backports or add candidates automatically to approved scope. Features remain excluded.The tag targets the signed voted commit; the stable branch retains the verified normal merge tip with the same tree. The worker rechecks candidate, roster, metadata-only delta and merge provenance, rejecting unrelated source changes. Roster changes require reassessment and a new vote.
After quality gates and draft-native checks, Go's existing release issue receives the actual qualified draft and evidence links; no second human review issue is created. A maintainer uses GitHub Publish release. Automation does not publish an official release. The same release ID, tag/commit, and asset IDs/hashes/sizes must pass anonymous public checks before consumers advance. Denied read-only draft access blocks the gate; native tests never receive a release-write credential.
Production limitation: the current worker creates the signed tag before draft review. A GitHub draft does not hide tags or prevent Go module downloads. The separate pre-tag maintainer gate is not implemented. Official stable release writes must stay disabled until it is implemented and validated.
Errors and blockers go to Go's release issue with Go maintainer mentions and failed stage/run/evidence links. Dependent issues receive concise blocker links rather than copied errors. The same issue receives the draft-ready notification; routine progress does not generate comments. Alerts are deduplicated per plan/repo/run/attempt, and a new failed retry can produce a new alert without changing approved scope. Subscribe to Go's issue and configure GitHub notifications; email is not guaranteed. Actions failures/logs are the fallback.
Pin, merge order and validation
Both
usesandworker_shacurrently pin953678d7760d177da9e3f4f61e928df8427eee24. Merge the companion CLI PR first, then rebind both to the final upstream merged implementation SHA before Go merges or activates. Unmerged draft pins cannot authorize execution; no fallback tomainis allowed.The caller passed actionlint and session contract checks for exact pins, typed inputs, explicit permissions/secrets, and the two-file scope. Shared release and canonical authorization regressions remain in the CLI repository. No live upstream release was run. This PR does not configure settings/secrets, activate scheduling, publish releases, or bypass existing governance.