From bd648def1f40f62b6f0bfd1dbc6e0d2b6f81b633 Mon Sep 17 00:00:00 2001 From: = Date: Fri, 7 Aug 2026 00:11:01 +0200 Subject: [PATCH 1/2] ci: group dependabot PRs and allow manual workflow runs Dependabot now opens a single grouped PR per ecosystem (nuget, github-actions) instead of one PR per package. Add workflow_dispatch to CI, CodeQL and Publish. Publish is tag-driven, so its dispatch takes a required tag input: the tag is validated, checked out, and used for the version, release tag_name and prerelease flag, keeping manual runs identical to tag pushes. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 10 +++++++++- .github/workflows/ci.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/publish.yml | 30 ++++++++++++++++++++++++++---- 4 files changed, 37 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b40e7c1..8ca4a0b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,7 +9,15 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + nuget: + patterns: + - "*" - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" \ No newline at end of file + interval: "weekly" + groups: + github-actions: + patterns: + - "*" \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c5446b2..1f39c60 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,7 @@ on: branches: - develop pull_request: + workflow_dispatch: concurrency: group: ci-${{ github.workflow }}-${{ github.ref }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7b359fe..b88a041 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -13,6 +13,7 @@ on: - develop schedule: - cron: '0 6 * * 1' # Every Monday at 06:00 UTC + workflow_dispatch: jobs: analyze: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9252f85..d7696a0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,6 +4,14 @@ on: push: tags: - 'v*' + # Allow re-running a release on demand (e.g. after a transient NuGet/MCP Registry failure). + # The tag must already exist: every step below derives the version from it. + workflow_dispatch: + inputs: + tag: + description: 'Existing release tag to publish (e.g. v1.0.3)' + required: true + type: string permissions: contents: write @@ -14,16 +22,29 @@ jobs: publish: runs-on: ubuntu-latest steps: + - name: Validate tag input + if: github.event_name == 'workflow_dispatch' + env: + TAG: ${{ inputs.tag }} + run: | + if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then + echo "::error::'$TAG' is not a valid release tag (expected e.g. v1.0.3 or v1.0.0-rc.1)." + exit 1 + fi + - uses: actions/checkout@v7 with: fetch-depth: 0 + ref: ${{ inputs.tag || github.ref }} - name: Extract version from tag id: get_version + env: + TAG: ${{ inputs.tag || github.ref_name }} run: | - VERSION=${GITHUB_REF_NAME#v} - echo "version=$VERSION" >> $GITHUB_OUTPUT - echo "Version: $VERSION" + echo "tag=$TAG" >> $GITHUB_OUTPUT + echo "version=${TAG#v}" >> $GITHUB_OUTPUT + echo "Tag: $TAG / Version: ${TAG#v}" - name: Update Directory.Build.props version run: | @@ -67,10 +88,11 @@ jobs: uses: softprops/action-gh-release@v3 with: files: artifacts/* + tag_name: ${{ steps.get_version.outputs.tag }} generate_release_notes: true draft: false # Treat a tag with a pre-release suffix (e.g. v1.0.0-rc.1) as a pre-release. - prerelease: ${{ contains(github.ref_name, '-') }} + prerelease: ${{ contains(steps.get_version.outputs.tag, '-') }} - name: Install mcp-publisher run: | From afccb033eca801bfd93f622f76367c951f08f658 Mon Sep 17 00:00:00 2001 From: = Date: Fri, 7 Aug 2026 00:26:28 +0200 Subject: [PATCH 2/2] ci: use github.event.inputs.tag in the publish workflow Addresses Copilot review feedback on #181. The `inputs` context is documented as available only for workflow_dispatch/workflow_call, and publish.yml also runs on tag pushes. `github.event.inputs` evaluates to empty on non-dispatch events and is equivalent here (string input, no workflow_call), so it is correct either way. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d7696a0..a8ed403 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -25,7 +25,7 @@ jobs: - name: Validate tag input if: github.event_name == 'workflow_dispatch' env: - TAG: ${{ inputs.tag }} + TAG: ${{ github.event.inputs.tag }} run: | if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then echo "::error::'$TAG' is not a valid release tag (expected e.g. v1.0.3 or v1.0.0-rc.1)." @@ -35,12 +35,12 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - ref: ${{ inputs.tag || github.ref }} + ref: ${{ github.event.inputs.tag || github.ref }} - name: Extract version from tag id: get_version env: - TAG: ${{ inputs.tag || github.ref_name }} + TAG: ${{ github.event.inputs.tag || github.ref_name }} run: | echo "tag=$TAG" >> $GITHUB_OUTPUT echo "version=${TAG#v}" >> $GITHUB_OUTPUT