Skip to content

Sync main back into staging (weekly release cycle workflows) - #254

Merged
pnewsam merged 6 commits into
stagingfrom
main
Jul 16, 2026
Merged

Sync main back into staging (weekly release cycle workflows)#254
pnewsam merged 6 commits into
stagingfrom
main

Conversation

@pnewsam

@pnewsam pnewsam commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Back-merges main into staging so staging picks up the weekly release cycle workflows (#220).

Commits carried: the #220 branch commits and merge commit (freeze/release-PR/unfreeze callers, reusable-workflow refactor, token permissions, SHA pins).

Merge this with a merge commit (not squash) — this repo allows it — so staging and main share history and this diff doesn't reappear next cycle.

🤖 Generated with Claude Code

pnewsam and others added 6 commits July 8, 2026 14:48
Replaces the single weekly-merge workflow with the freeze/release-PR/unfreeze
lifecycle established in mindshub_inference#319: staging-freeze locks staging
on a weekly cron, weekly-merge-staging opens the staging->main release PR, and
staging-unfreeze unlocks staging when the release PR merges. Branch-protection
changes go through a shared set-branch-lock.js helper using RELEASE_AUTOMATION_TOKEN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…orkflows

Replaces the self-contained freeze/release-PR/unfreeze workflows and the
set-branch-lock.js helper with ~15-line callers of the reusable workflows in
mindsdb/github-actions (see mindsdb/github-actions#32). Workflow names are
preserved so the workflow_run chain still fires.

Auth now uses the mindsdb-release-train GitHub App (minted per-job in the
reusable workflows) instead of a PAT; freeze/unfreeze toggle the pre-provisioned
staging-freeze ruleset instead of round-tripping branch protection. The
unfreeze caller carries the merged-release-PR + fork-PR guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a top-level 'permissions: contents: read' block to each caller so the
GITHUB_TOKEN is least-privilege (fixes CodeQL actions/missing-workflow-permissions).
All privileged operations run through the mindsdb-release-train App token, so
contents: read is sufficient for the callers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…eeze)

Follows the rename in mindsdb/github-actions#32. Caller filenames and workflow
names are unchanged; only the uses: target paths move.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add weekly release cycle workflows (freeze, release PR, unfreeze)
@pnewsam
pnewsam requested a review from a team as a code owner July 16, 2026 22:12
@pnewsam
pnewsam merged commit 0ccb06a into staging Jul 16, 2026
11 checks passed
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 16, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant