main is what's in prod today: protected, PR-only, never pushed to directly by
anything (human or bot). dev is where work — including automated dependency
bumps — accumulates ahead of the next release.
.github/workflows/headroom-release-watch.yml polls headroomlabs-ai/headroom
daily for a new release newer than FLOOR. When one appears, it:
- Re-pins
headroom-coreto the new release tag. - Builds + tests (lexical/no-ml) — must be green before anything is pushed.
- Bumps this crate's own patch version.
- Pushes the commit to
dev. - Opens a PR from
dev->main(or pushes onto an already-open one), requesting review from the repo owner.
Nothing is tagged or published at this point — the bump only exists on dev and
in an open PR.
Once that PR is reviewed and merged into main,
.github/workflows/headroom-release-publish.yml triggers automatically (on the
PR's closed+merged event), and:
- Reads the version from
main'sCargo.toml. - Tags the merged commit
vX.Y.Z. - Triggers
docker.ymlandrelease.ymlagainst that tag (viaworkflow_dispatch, since aGITHUB_TOKEN-pushed tag doesn't self-triggeron: push: tags:) — these build and publish the signed plugin tarballs and thegetbusbar/headroom-hookimage.
So: reviewing/merging the dev -> main PR is the one human touchpoint in an otherwise fully automated pipeline — approve it (GitHub's normal "review requested" email works for this) and the tag + publish happen on their own.
Anything not driven by the upstream-headroom bump (a manual feature, a fix) goes
through the same shape by hand: commit to a branch off dev, PR into dev,
then PR dev -> main when ready to ship — merging that PR triggers the same
tag-and-publish automation above.