ci(release): Switch from action-prepare-release to Craft #106005
+36
−11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow - Update .craft.yml with versioning.policy: calver
Contributor
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨Aci
Ai ConversationsAutopilot
Code Review
Dashboards
Dynamic Grouping
Dynamic Groups
Explorer
Grouping
Issues
Occurrences On Eap
Preprod
Projects
Replay
Seer
StoriesTop IssuesTracemetrics
Uptime
Other
Bug Fixes 🐛Aci
Alerts
Billing
Checkout
Code Mappings
Code Review
Codeowners
Dashboards
Explore
Grouping
Issues
Preprocessing
Preprod
Security
Seer
Stories
Tracemetrics
Ui
Uptime
Other
Documentation 📚
Build / dependencies / internal 🔧Aci
Admin
Alerts
Api
Ask Seer
Auth
Billing
Checkout
Code Review
Core
Dashboards
Discover
Explorer
Grouping
Insights
Issue Search
Layout
Llm Detector
Preprod
Scraps
Seer
Sentry Apps
Settings
Theme
Ui
Uptime
Other
Other
Plus 66 more 🤖 This preview updates automatically when you update the PR. |
.github/workflows/release.yml
Outdated
| version: ${{ github.event.inputs.version }} | ||
| force: ${{ github.event.inputs.force }} | ||
| calver: true | ||
| uses: getsentry/craft/.github/workflows/release.yml@v2 |
Member
There was a problem hiding this comment.
Are these release tags immutable? We purposely pin all actions to sha's in sentry
Member
Author
There was a problem hiding this comment.
They are not and it is on purpose. This should be okay for Craft.
Member
There was a problem hiding this comment.
What's the harm in using the sha? It keeps convention of all the other actions in the repo so that's what I would prefer
The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} | ||
| private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }} | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v2 |
Contributor
There was a problem hiding this comment.
Checkout action downgraded from v4 to v2
High Severity
The actions/checkout action was downgraded from v4.1.7 to v2 (as indicated by the comment # v2). This is inconsistent with all other workflows in the repository which use v4.1.7 (@692973e3d937129bcbf40652eb9f2f61becf3332). Version 2 is significantly older, uses deprecated Node.js 12, and lacks important security fixes and features present in v4. This appears to be an accidental regression.
|
|
||
| jobs: | ||
| changelog-preview: | ||
| uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2 |
Contributor
There was a problem hiding this comment.
Craft reusable workflow uses mutable tag instead of SHA (Bugbot Rules)
Medium Severity
The PR discussion explicitly states the team convention to "pin all actions to sha's in sentry." However, the changelog-preview.yml workflow references getsentry/craft/.github/workflows/changelog-preview.yml@v2 using a mutable tag, while release.yml in the same PR correctly SHA-pins the Craft action with @39ee616a6a58dc64797feecb145d66770492b66c. This inconsistency violates the stated team convention and could cause reproducibility issues if the v2 tag changes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR migrates from the deprecated
action-prepare-releaseto the new Craft GitHub Actions.Changes
.github/workflows/release.ymlto Craft reusable workflow.craft.ymlwithversioning.policy: calverDocumentation
See https://getsentry.github.io/craft/github-actions/ for more information.