Skip to content

ci: record releases in Linear, pin and update workflow actions #300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gorandodig merged 4 commits into from
Aug 28, 2026
Merged

ci: record releases in Linear, pin and update workflow actions #300

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2aa23d2
ci: record releases in Linear, pin and update workflow actions
gorandodig Aug 24, 2026
ea1d37a
Notify Slack when the release is published but not recorded
gorandodig Aug 25, 2026
b41ec03
Pin every workflow action to a commit SHA
gorandodig Aug 25, 2026
7f749ba
Disable release recording until the infrastructure is ready
gorandodig Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,21 @@ updates:
commit-message:
prefix: "dependabot"
labels:
- "dependencies"
- "dependencies"

# Keeps the SHA-pinned actions in publish-to-pypi.yml patched.
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
commit-message:
prefix: "ci"
labels:
- "dependencies"
- "github-actions"
groups:
actions-minor-and-patch:
update-types:
- "minor"
- "patch"
14 changes: 8 additions & 6 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- uses: actions/setup-python@v5
- uses: actions/setup-python@v7
with:
python-version: '3.12'

Expand All @@ -39,7 +39,7 @@ jobs:

- name: Upload generated outputs on failure
if: failure()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: e2e-outputs-linux
path: /tmp/pytest-of-runner/**/container_work*/**
Expand All @@ -48,9 +48,9 @@ jobs:
runs-on: windows-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- uses: actions/setup-python@v5
- uses: actions/setup-python@v7
with:
python-version: '3.12'

Expand Down Expand Up @@ -81,8 +81,10 @@ jobs:

- name: Send failure notification to Slack
if: ${{ env.SLACK_WEBHOOK_URL != '' }}
uses: slackapi/slack-github-action@v1.24.0
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
with:
webhook: ${{ env.SLACK_WEBHOOK_URL }}
webhook-type: incoming-webhook
payload: |
{
"text": ${{ toJSON(format('[Codeplain Client] E2E tests FAILED on {0}. See <{1}/{2}/actions/runs/{3}|the run log>.', steps.platforms.outputs.failed, github.server_url, github.repository, github.run_id)) }}
Expand Down
36 changes: 19 additions & 17 deletions .github/workflows/lint-and-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ jobs:
name: Black Formatting
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v7
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Cache pip
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
Expand All @@ -33,13 +33,13 @@ jobs:
name: Import Sorting
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v7
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Cache pip
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
Expand All @@ -54,13 +54,13 @@ jobs:
name: Flake8 Linting
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v7
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Cache pip
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
Expand All @@ -75,13 +75,13 @@ jobs:
name: MyPy Type Checking
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v7
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Cache pip
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
Expand All @@ -96,9 +96,9 @@ jobs:
name: Run Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v7
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Configure git for tests
Expand All @@ -107,7 +107,7 @@ jobs:
git config --global user.name "Test Runner"
git config --global init.defaultBranch main
- name: Cache pip
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
Expand All @@ -122,5 +122,7 @@ jobs:
coverage run -m pytest tests/ -v
coverage xml
coverage report
- name: Upload coverage reports
uses: codecov/codecov-action@v3
# Disabled: v3's Node runtime is gone from the runners. Re-enable with a
# current major version, which renamed several inputs.
# - name: Upload coverage reports
# uses: codecov/codecov-action@v3
4 changes: 2 additions & 2 deletions .github/workflows/lint-powershell.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
name: Parse under Windows PowerShell 5.1
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

# The install scripts are fetched over HTTP and executed on stock Windows,
# where powershell.exe (5.1) is the default shell. 5.1 reads BOM-less files
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
name: Parse under PowerShell 7
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Parse each script with 7
shell: pwsh
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/nofity-slack-on-main-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ jobs:
if: github.event.pull_request.merged == true
steps:
- name: Send notification to Slack
uses: slackapi/slack-github-action@v1.24.0
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
with:
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
webhook-type: incoming-webhook
payload: |
{
"text": ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, github.event.pull_request.title, github.actor)) }}
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
2 changes: 1 addition & 1 deletion .github/workflows/publish-install-script.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@zanjonke zanjonke Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as in plain-forge repo - I think it would be better to stay consistent with pins so as to avoid any discrepancies and catch issues early rather than in the deploy job.

This applies also to all other un-pinned actions.

@gorandodig gorandodig Aug 25, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, and done.


- name: Upload install scripts to R2
env:
Expand Down
32 changes: 28 additions & 4 deletions .github/workflows/publish-to-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# hatch-vcs derives the version from git tags, so we need full history.
fetch-depth: 0
Expand All @@ -46,7 +46,7 @@ jobs:
ls -l dist/

- name: Store the distribution packages
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: python-package-distributions
path: dist/
Expand Down Expand Up @@ -81,13 +81,13 @@ jobs:

steps:
- name: Download distribution packages
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: python-package-distributions
path: dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

- name: Notify Slack (success)
if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
Expand All @@ -102,3 +102,27 @@ jobs:
curl -s -X POST "$SLACK_WEBHOOK_URL" \
-H 'Content-type: application/json' \
--data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"

# Runs only after the package is on PyPI. Kept as its own job so the publish job
# keeps its minimal permissions and no checkout.
linear-release:
name: Record release in Linear
needs: publish-to-pypi
runs-on: ubuntu-latest

permissions:
contents: read

steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# The scan needs full history.
fetch-depth: 0

# Non-fatal: the package is already published.
- name: Record release in Linear
continue-on-error: true
uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0

@zanjonke zanjonke Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just leaving a note here. This SHA pins the install script that downloads the binary which is then the linear CLI and not the CLI itself. Which only half solves the security issues.

@gorandodig gorandodig Aug 25, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct. Pinning the action fixes the code that runs, not the binary it downloads at runtime. CLI pinned to version tag now.

with:
access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
version: ${{ github.ref_name }}

@zanjonke zanjonke Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this step fails nothing will get logged anywhere. For the publish-to-pypi we have a dedicated SLACK webhook.

@gorandodig gorandodig Aug 25, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, fixed in ea1d37a.