Repository navigation
Release from the tag: crates, image and GitHub Release by one workflow (0.1.2) - #15
Merged
Merged
Conversation
…w (0.1.2) A release was three remote writes typed by hand after the merge (tag push, `cargo publish` for the SDK crates, and the image through the old release workflow), driven for 0.1.1 by a script pair written during the release and by a long-lived `cargo login` token on one machine. Now the tag push is the only thing a person does. `release.yml` on a `v*` tag: `check` refuses a tag whose version is not the manifest's or whose commit is not on main; `crates` runs `just package`, cargo-semver-checks against the published versions, then publishes whichever of evalhub-schema / -core / -query is not on crates.io at that version, authenticated by crates.io Trusted Publishing (OIDC from this repository and workflow file; no stored token; the first version of each crate had to be published by hand, which 0.1.0 was); `image` is unchanged; `release` creates the GitHub Release with the merged pull request's body as notes. A rerun publishes nothing twice and leaves an existing release alone. `deploy/release/land.sh <pr> <issue>` merges with a merge commit (never squash: the commits carry the Signed-off-by), closes the issue, fast-forwards main, and hands to `deploy/release/tag.sh`, which waits for main's CI, tags once, pushes, and follows the workflow to the end. `just semver-check` is the same API check by hand. release-plz as in dsl-kit was considered and not taken: its version and changelog come from Conventional Commit headers this repository does not use, and its release PR carries a bot commit without a sign-off. Version 0.1.2, so that this change is released by the workflow it adds: the tag will point at a commit that contains it. No Rust code changed. Verified: bash -n on both scripts; release.yml parses; the PR lookup by merge sha returns #13 for the 0.1.1 merge commit; `gh run watch --exit-status` exists; cargo fmt --check, cargo clippy --workspace --all-targets -D warnings, cargo test -p evalhub-schema / -core / -query, `just package` at 0.1.2, `just semver-check` against 0.1.1. Trusted Publishing is enabled on crates.io for the three crates. Refs #14 Signed-off-by: Yutaka Nishimura <ytk.nishimura@gmail.com>
ynishi
force-pushed
the
chore/release-ci
branch
from
September 22, 2026 10:36
1e9ad4c to
532b4a4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tag push becomes the only release action a person takes; the
releaseworkflow does the rest.What changes
.github/workflows/release.ymlon av*tag:check: the tag names the version inCargo.tomland the tagged commit is onmain; otherwise nothing runs.crates:just package,cargo semver-checksagainst the versions on crates.io, thencargo publishfor whichever ofevalhub-schema/evalhub-core/evalhub-queryis not yet on crates.io at that version. Authentication is crates.io Trusted Publishing (OIDC,rust-lang/crates-io-auth-action); no token is stored. A rerun publishes nothing twice.image: as before (ghcr.io/ynishi/evalhub:<version>,:latest).release: a GitHub Release for the tag, notes from the merged pull request's body plus crate and image links.deploy/release/land.sh <pr> <issue>: merge with a merge commit (never squash), close the issue, fast-forwardmain, thentag.sh.deploy/release/tag.sh: onmain, clean, HEAD isorigin/main, CI for HEAD green (waits), version fromCargo.toml, tag once, push, follow the workflow withgh run watch.just semver-check; CONTRIBUTING §Releases; pointers in AGENTS.md anddocs/hosting.md.Why not release-plz (dsl-kit's flow)
Its version and changelog are computed from Conventional Commit headers, which this repository does not use (prose subjects, bump riding with the last change), and its release PR carries a bot commit without
Signed-off-by. What it is for (no hand-typed publish, one tag as the trigger, a semver check, a release page) is taken; the rest is left.0.1.2
This PR is the release that exercises the workflow it adds: the version bump rides in its one commit, and landing it (
deploy/release/land.sh 15 14) tagsv0.1.2from a commit that containsrelease.yml. No Rust code changed since 0.1.1.Verified
bash -non both scripts;release.ymlparses; the PR lookup by merge sha returns Hosting: SDK crates on crates.io, the application as an image, the service on Fly.io (0.1.1) #13 for the 0.1.1 merge commit;gh run watch --exit-statusexists.cargo fmt --check,cargo clippy --workspace --all-targets -D warnings,cargo test -p evalhub-schema / -core / -query,just packageat 0.1.2,just semver-checkagainst 0.1.1.ynishi/evalhub, workflowrelease.yml).Refs #14