From 2aa23d271517690a043af560eb656dfe1fa007be Mon Sep 17 00:00:00 2001 From: Goran Dodig Date: Mon, 24 Aug 2026 23:38:59 +0200 Subject: [PATCH 1/4] ci: record releases in Linear, pin and update workflow actions A linear-release job records each PyPI release, gated on a successful publish. It is a separate job because the publish job has no checkout and holds only id-token: write for Trusted Publishing. The release is identified by the tag. publish-to-pypi.yml is SHA-pinned. pypa/gh-action-pypi-publish was on the release/v1 branch ref, which moves on every push, next to the PyPI OIDC token. Other workflows stay on tags. Bumped checkout v7, setup-python v7, cache v6, upload-artifact v7, download-artifact v8. Slack action v4.0.0 needs webhook-type from v2 on. The e2e notification now passes the job's own webhook secret rather than the default one. Codecov v3 disabled: its Node runtime is gone from the runners. Coverage is still computed and printed. Dependabot now covers github-actions alongside pip. --- .github/dependabot.yml | 19 +++++++++- .github/workflows/e2e.yml | 14 ++++---- .github/workflows/lint-and-test.yml | 36 ++++++++++--------- .github/workflows/lint-powershell.yml | 4 +-- .../workflows/nofity-slack-on-main-merge.yml | 6 ++-- .github/workflows/publish-install-script.yml | 2 +- .github/workflows/publish-to-pypi.yml | 32 ++++++++++++++--- 7 files changed, 79 insertions(+), 34 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb3dfe7a..563b00d1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,4 +8,21 @@ updates: commit-message: prefix: "dependabot" labels: - - "dependencies" \ No newline at end of file + - "dependencies" + + # Keeps the SHA-pinned actions in publish-to-pypi.yml patched. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + commit-message: + prefix: "ci" + labels: + - "dependencies" + - "github-actions" + groups: + actions-minor-and-patch: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 9e0f6f9f..6fd62efd 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -11,9 +11,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.12' @@ -39,7 +39,7 @@ jobs: - name: Upload generated outputs on failure if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: e2e-outputs-linux path: /tmp/pytest-of-runner/**/container_work*/** @@ -48,9 +48,9 @@ jobs: runs-on: windows-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.12' @@ -81,8 +81,10 @@ jobs: - name: Send failure notification to Slack if: ${{ env.SLACK_WEBHOOK_URL != '' }} - uses: slackapi/slack-github-action@v1.24.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: + webhook: ${{ env.SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook payload: | { "text": ${{ toJSON(format('[Codeplain Client] E2E tests FAILED on {0}. See <{1}/{2}/actions/runs/{3}|the run log>.', steps.platforms.outputs.failed, github.server_url, github.repository, github.run_id)) }} diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml index c757e5e1..4fd30c6e 100644 --- a/.github/workflows/lint-and-test.yml +++ b/.github/workflows/lint-and-test.yml @@ -12,13 +12,13 @@ jobs: name: Black Formatting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -33,13 +33,13 @@ jobs: name: Import Sorting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -54,13 +54,13 @@ jobs: name: Flake8 Linting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -75,13 +75,13 @@ jobs: name: MyPy Type Checking runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -96,9 +96,9 @@ jobs: name: Run Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ env.PYTHON_VERSION }} - name: Configure git for tests @@ -107,7 +107,7 @@ jobs: git config --global user.name "Test Runner" git config --global init.defaultBranch main - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -122,5 +122,7 @@ jobs: coverage run -m pytest tests/ -v coverage xml coverage report - - name: Upload coverage reports - uses: codecov/codecov-action@v3 + # Disabled: v3's Node runtime is gone from the runners. Re-enable with a + # current major version, which renamed several inputs. + # - name: Upload coverage reports + # uses: codecov/codecov-action@v3 diff --git a/.github/workflows/lint-powershell.yml b/.github/workflows/lint-powershell.yml index c12e1ada..b8ffb373 100644 --- a/.github/workflows/lint-powershell.yml +++ b/.github/workflows/lint-powershell.yml @@ -16,7 +16,7 @@ jobs: name: Parse under Windows PowerShell 5.1 runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # The install scripts are fetched over HTTP and executed on stock Windows, # where powershell.exe (5.1) is the default shell. 5.1 reads BOM-less files @@ -96,7 +96,7 @@ jobs: name: Parse under PowerShell 7 runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Parse each script with 7 shell: pwsh diff --git a/.github/workflows/nofity-slack-on-main-merge.yml b/.github/workflows/nofity-slack-on-main-merge.yml index a9a91c56..1d5e8a05 100644 --- a/.github/workflows/nofity-slack-on-main-merge.yml +++ b/.github/workflows/nofity-slack-on-main-merge.yml @@ -12,11 +12,11 @@ jobs: if: github.event.pull_request.merged == true steps: - name: Send notification to Slack - uses: slackapi/slack-github-action@v1.24.0 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: + webhook: ${{ secrets.SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook payload: | { "text": ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, github.event.pull_request.title, github.actor)) }} } - env: - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} diff --git a/.github/workflows/publish-install-script.yml b/.github/workflows/publish-install-script.yml index 94f2b1b0..72be001b 100644 --- a/.github/workflows/publish-install-script.yml +++ b/.github/workflows/publish-install-script.yml @@ -18,7 +18,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Upload install scripts to R2 env: diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml index 01d06903..7665e468 100644 --- a/.github/workflows/publish-to-pypi.yml +++ b/.github/workflows/publish-to-pypi.yml @@ -19,7 +19,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # hatch-vcs derives the version from git tags, so we need full history. fetch-depth: 0 @@ -46,7 +46,7 @@ jobs: ls -l dist/ - name: Store the distribution packages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: python-package-distributions path: dist/ @@ -81,13 +81,13 @@ jobs: steps: - name: Download distribution packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: python-package-distributions path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 - name: Notify Slack (success) if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }} @@ -102,3 +102,27 @@ jobs: curl -s -X POST "$SLACK_WEBHOOK_URL" \ -H 'Content-type: application/json' \ --data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}" + + # Runs only after the package is on PyPI. Kept as its own job so the publish job + # keeps its minimal permissions and no checkout. + linear-release: + name: Record release in Linear + needs: publish-to-pypi + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # The scan needs full history. + fetch-depth: 0 + + # Non-fatal: the package is already published. + - name: Record release in Linear + continue-on-error: true + uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0 + with: + access_key: ${{ secrets.LINEAR_ACCESS_KEY }} + version: ${{ github.ref_name }} From ea1d37a3a3ab7f58c442ede856146f44e85c7594 Mon Sep 17 00:00:00 2001 From: Goran Dodig Date: Tue, 25 Aug 2026 15:59:24 +0200 Subject: [PATCH 2/4] Notify Slack when the release is published but not recorded The step is non-fatal by design, which also meant a failure was invisible: the job stayed green and nothing was logged. It now checks the step's own outcome, since failure() never fires when continue-on-error swallows the error. Also pins the CLI version the action downloads. Pinning the action alone still left the binary it fetches floating. --- .github/workflows/publish-to-pypi.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml index 7665e468..c37b2cdb 100644 --- a/.github/workflows/publish-to-pypi.yml +++ b/.github/workflows/publish-to-pypi.yml @@ -113,6 +113,9 @@ jobs: permissions: contents: read + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -121,8 +124,20 @@ jobs: # Non-fatal: the package is already published. - name: Record release in Linear + id: linear continue-on-error: true uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0 with: access_key: ${{ secrets.LINEAR_ACCESS_KEY }} version: ${{ github.ref_name }} + # Pin the CLI the action downloads, not just the action. + cli_version: v0.16.0 + + # continue-on-error keeps the job green, so this checks the step's own + # outcome — `failure()` would never fire. + - name: Notify Slack (release not recorded) + if: ${{ steps.linear.outcome == 'failure' && env.SLACK_WEBHOOK_URL != '' }} + run: | + curl -s -X POST "$SLACK_WEBHOOK_URL" \ + -H 'Content-type: application/json' \ + --data "{\"text\":\"*Codeplain Client*: \`${{ github.ref_name }}\` is on PyPI, but recording it in Linear FAILED :warning:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}" From b41ec03af0441b349f52f0df569596ac971d5aea Mon Sep 17 00:00:00 2001 From: Goran Dodig Date: Tue, 25 Aug 2026 15:59:47 +0200 Subject: [PATCH 3/4] Pin every workflow action to a commit SHA Previously only the workflows holding id-token: write were pinned, on the grounds that the rest had a smaller blast radius. That left CI and the publish path running different versions of the same actions, so a bad release would surface in a deploy rather than in a pull request. Pinning everything makes the version CI exercises the version that publishes. Dependabot moves them together. --- .github/workflows/e2e.yml | 14 ++++----- .github/workflows/lint-and-test.yml | 30 ++++++++++---------- .github/workflows/lint-powershell.yml | 4 +-- .github/workflows/publish-install-script.yml | 2 +- 4 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 6fd62efd..840ed777 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -11,19 +11,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - run: pip install pytest - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build E2E image (cached) - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: tests/e2e/Dockerfile @@ -39,7 +39,7 @@ jobs: - name: Upload generated outputs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-outputs-linux path: /tmp/pytest-of-runner/**/container_work*/** @@ -48,9 +48,9 @@ jobs: runs-on: windows-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml index 4fd30c6e..fd135f0b 100644 --- a/.github/workflows/lint-and-test.yml +++ b/.github/workflows/lint-and-test.yml @@ -12,13 +12,13 @@ jobs: name: Black Formatting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -33,13 +33,13 @@ jobs: name: Import Sorting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -54,13 +54,13 @@ jobs: name: Flake8 Linting runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -75,13 +75,13 @@ jobs: name: MyPy Type Checking runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} @@ -96,9 +96,9 @@ jobs: name: Run Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Configure git for tests @@ -107,7 +107,7 @@ jobs: git config --global user.name "Test Runner" git config --global init.defaultBranch main - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }} diff --git a/.github/workflows/lint-powershell.yml b/.github/workflows/lint-powershell.yml index b8ffb373..b67ec7b8 100644 --- a/.github/workflows/lint-powershell.yml +++ b/.github/workflows/lint-powershell.yml @@ -16,7 +16,7 @@ jobs: name: Parse under Windows PowerShell 5.1 runs-on: windows-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # The install scripts are fetched over HTTP and executed on stock Windows, # where powershell.exe (5.1) is the default shell. 5.1 reads BOM-less files @@ -96,7 +96,7 @@ jobs: name: Parse under PowerShell 7 runs-on: windows-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Parse each script with 7 shell: pwsh diff --git a/.github/workflows/publish-install-script.yml b/.github/workflows/publish-install-script.yml index 72be001b..bc0cf251 100644 --- a/.github/workflows/publish-install-script.yml +++ b/.github/workflows/publish-install-script.yml @@ -18,7 +18,7 @@ jobs: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Upload install scripts to R2 env: From 7f749ba08e61c12977b4e120152246f3fdd603b1 Mon Sep 17 00:00:00 2001 From: Goran Dodig Date: Fri, 28 Aug 2026 16:21:39 +0200 Subject: [PATCH 4/4] Disable release recording until the infrastructure is ready Commented out rather than removed, so re-enabling is a straight uncomment. --- .github/workflows/publish-to-pypi.yml | 79 ++++++++++++++------------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml index c37b2cdb..ccff0eec 100644 --- a/.github/workflows/publish-to-pypi.yml +++ b/.github/workflows/publish-to-pypi.yml @@ -103,41 +103,44 @@ jobs: -H 'Content-type: application/json' \ --data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}" - # Runs only after the package is on PyPI. Kept as its own job so the publish job - # keeps its minimal permissions and no checkout. - linear-release: - name: Record release in Linear - needs: publish-to-pypi - runs-on: ubuntu-latest - - permissions: - contents: read - - env: - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} - - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - # The scan needs full history. - fetch-depth: 0 - - # Non-fatal: the package is already published. - - name: Record release in Linear - id: linear - continue-on-error: true - uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0 - with: - access_key: ${{ secrets.LINEAR_ACCESS_KEY }} - version: ${{ github.ref_name }} - # Pin the CLI the action downloads, not just the action. - cli_version: v0.16.0 - - # continue-on-error keeps the job green, so this checks the step's own - # outcome — `failure()` would never fire. - - name: Notify Slack (release not recorded) - if: ${{ steps.linear.outcome == 'failure' && env.SLACK_WEBHOOK_URL != '' }} - run: | - curl -s -X POST "$SLACK_WEBHOOK_URL" \ - -H 'Content-type: application/json' \ - --data "{\"text\":\"*Codeplain Client*: \`${{ github.ref_name }}\` is on PyPI, but recording it in Linear FAILED :warning:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}" + # Release pipelines to be turned on only after the rest of the infrastructure + # is ready. + # + # # Runs only after the package is on PyPI. Kept as its own job so the publish job + # # keeps its minimal permissions and no checkout. + # linear-release: + # name: Record release in Linear + # needs: publish-to-pypi + # runs-on: ubuntu-latest + # + # permissions: + # contents: read + # + # env: + # SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + # + # steps: + # - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # with: + # # The scan needs full history. + # fetch-depth: 0 + # + # # Non-fatal: the package is already published. + # - name: Record release in Linear + # id: linear + # continue-on-error: true + # uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0 + # with: + # access_key: ${{ secrets.LINEAR_ACCESS_KEY }} + # version: ${{ github.ref_name }} + # # Pin the CLI the action downloads, not just the action. + # cli_version: v0.16.0 + # + # # continue-on-error keeps the job green, so this checks the step's own + # # outcome — `failure()` would never fire. + # - name: Notify Slack (release not recorded) + # if: ${{ steps.linear.outcome == 'failure' && env.SLACK_WEBHOOK_URL != '' }} + # run: | + # curl -s -X POST "$SLACK_WEBHOOK_URL" \ + # -H 'Content-type: application/json' \ + # --data "{\"text\":\"*Codeplain Client*: \`${{ github.ref_name }}\` is on PyPI, but recording it in Linear FAILED :warning:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"