From 6e049b94f2dce202cc1805a1299e8c9df9c52d8b Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 21:32:09 +0200 Subject: [PATCH 1/6] fix(ci): allow release manifest ahead of latest tag --- .github/workflows/release.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6ac0f2f..cb76c88 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,8 +50,15 @@ jobs: exit 0 fi - if [[ "$manifest_version" != "$latest_tag" ]]; then - echo "ERROR: .release-please-manifest.json is stale." + if [[ ! "$manifest_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "ERROR: invalid .release-please-manifest.json version: $manifest_version" + exit 1 + fi + + # A merged release-please PR can make manifest_version temporarily newer than latest_tag. + # That state is valid; only fail if manifest_version is behind the newest existing tag. + if [[ "$(printf '%s\n%s\n' "$latest_tag" "$manifest_version" | sort -V | tail -n 1)" == "$latest_tag" && "$manifest_version" != "$latest_tag" ]]; then + echo "ERROR: .release-please-manifest.json is stale (behind latest tag)." echo "manifest version: $manifest_version" echo "latest git tag: $latest_tag" echo "Update .release-please-manifest.json before running release orchestration." From 98d8ee1c3e6680ab16fa07b7781bbec8db71ae3c Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 21:32:50 +0200 Subject: [PATCH 2/6] docs(release): restore release-please style for 2.0.x --- CHANGELOG.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8125714..7aa3e20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,23 @@ ## [2.0.3](https://github.com/eschaar/vstack/compare/2.0.2...2.0.3) (2026-04-28) +### Maintenance + +- **ci:** harden release workflows and normalize changelog ([5a38709](https://github.com/eschaar/vstack/commit/5a387091dcea8dc7545bda5430fd02aee88ac0af)) +- **ci:** restructure pipeline with release-please and GitHub App token ([8c06090](https://github.com/eschaar/vstack/commit/8c060906ae7d8a662ff1e772fa531484eafb1067)) +- **ci:** restructure pipeline with release-please and GitHub App token ([#30](https://github.com/eschaar/vstack/issues/30)) ([0008127](https://github.com/eschaar/vstack/commit/0008127fafbf261fbbf6363fe9a4eb7769edfe83)) + +## [2.0.2](https://github.com/eschaar/vstack/compare/2.0.1...2.0.2) (2026-04-27) + +### Maintenance + +- **ci:** bump trufflesecurity/trufflehog from 3.94.3 to 3.95.2 ([#25](https://github.com/eschaar/vstack/issues/25)) ([5724dbe](https://github.com/eschaar/vstack/commit/5724dbe605523da2c90a4f143fa8c4a92322adf4)) + +## [2.0.1](https://github.com/eschaar/vstack/compare/2.0.0...2.0.1) (2026-04-27) ### Maintenance -* **ci:** harden release workflows and normalize changelog ([5a38709](https://github.com/eschaar/vstack/commit/5a387091dcea8dc7545bda5430fd02aee88ac0af)) -* **ci:** restructure pipeline with release-please and GitHub App token ([8c06090](https://github.com/eschaar/vstack/commit/8c060906ae7d8a662ff1e772fa531484eafb1067)) -* **ci:** restructure pipeline with release-please and GitHub App token ([#30](https://github.com/eschaar/vstack/issues/30)) ([0008127](https://github.com/eschaar/vstack/commit/0008127fafbf261fbbf6363fe9a4eb7769edfe83)) +- **ci:** bump actions/download-artifact from 7 to 8 ([#26](https://github.com/eschaar/vstack/issues/26)) ([24d5a58](https://github.com/eschaar/vstack/commit/24d5a585c37fe8097de41863e0085917e81a376f)) ## 2.0.0 (2026-04-26) From ca6155c2f117c3e9a8ebf43d7f7a926e6dce264f Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 21:49:19 +0200 Subject: [PATCH 3/6] chore(ci): tune dependabot automerge policy --- .github/dependabot.yml | 4 ++-- .github/workflows/automerge.yml | 28 ++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5a5dc33..b5b43f3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,7 @@ updates: interval: "weekly" assignees: - "eschaar" - open-pull-requests-limit: 10 + open-pull-requests-limit: 6 labels: - "dependencies" - "python" @@ -26,7 +26,7 @@ updates: interval: "weekly" assignees: - "eschaar" - open-pull-requests-limit: 5 + open-pull-requests-limit: 6 labels: - "dependencies" - "github-actions" diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index a639a05..a4d1e48 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -63,6 +63,34 @@ jobs: body: "Auto-approved for safe Dependabot update policy." }) + - name: Update branch for eligible PR + if: steps.decision.outputs.should_automerge == 'true' + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + // Intentional strategy: + // - Always request an update for eligible PRs instead of pre-checking merge state. + // - GitHub may report transient/unknown merge state during event handling. + // - updateBranch is idempotent; if already current, GitHub returns a benign 422/no-op. + // This keeps automerge flow deterministic without relying on flaky preconditions. + try { + await github.rest.pulls.updateBranch({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number + }) + core.info("Requested branch update from base branch.") + } catch (error) { + const msg = String(error.message || "") + if (error.status === 422 || msg.includes("not behind")) { + // Expected no-op path when branch is already up to date. + core.info("Branch already up to date; continuing.") + } else { + core.setFailed("Could not update branch before automerge. " + msg) + } + } + - name: Enable auto-merge for eligible PR if: steps.decision.outputs.should_automerge == 'true' uses: actions/github-script@v7 From db701d5cf6ba3a370c2eb8333c49ed63176872bb Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 21:50:31 +0200 Subject: [PATCH 4/6] chore(ci): bump automerge action dependencies --- .github/workflows/automerge.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index a4d1e48..68e2486 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2 + uses: dependabot/fetch-metadata@v3 with: github-token: ${{ secrets.GITHUB_TOKEN }} @@ -51,7 +51,7 @@ jobs: - name: Approve eligible PR if: steps.decision.outputs.should_automerge == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -65,7 +65,7 @@ jobs: - name: Update branch for eligible PR if: steps.decision.outputs.should_automerge == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -93,7 +93,7 @@ jobs: - name: Enable auto-merge for eligible PR if: steps.decision.outputs.should_automerge == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | From 41987971d521dbf8f257863b155de6c3503a6d65 Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 21:57:03 +0200 Subject: [PATCH 5/6] chore(ci): use app client id for release token generation --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb76c88..7912aae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,9 +26,10 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.APP_ID }} + # v3 requires the GitHub App client ID. + client-id: ${{ secrets.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - name: Checkout repository metadata From c3fe47498b84ecfc44c3ccd39b9c81215f00e47c Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Tue, 28 Apr 2026 22:13:36 +0200 Subject: [PATCH 6/6] chore(deps): tune dependabot cadence and PR limits --- .github/dependabot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b5b43f3..66bd500 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,7 @@ updates: interval: "weekly" assignees: - "eschaar" - open-pull-requests-limit: 6 + open-pull-requests-limit: 5 labels: - "dependencies" - "python" @@ -23,10 +23,10 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "daily" assignees: - "eschaar" - open-pull-requests-limit: 6 + open-pull-requests-limit: 5 labels: - "dependencies" - "github-actions"