Repository navigation
chore: follow upstream with bump branches instead of next - #133
Merged
Merged
Conversation
Since the move to the ai-openshell org, the `next` machinery no longer works: nobody is an admin, main's ruleset resets approval on every push (and `next` was force-pushed hourly), and the enterprise refuses the long-lived UPSTREAM_BOT_TOKEN. - Follow upstream runs once a day. For a new stable OpenShell release it creates bump/openshell-X.Y.Z from main with one signed-off pin-move commit, starts CI on it with workflow_dispatch (a PR opened with the default token starts none) and opens a PR into main. It makes a bump branch once and never rebases, moves or force-pushes it. - A person can run it with a `version` to make a prep branch for a pre-release. Check A still runs nightly against upstream's newest pre-release and keeps the compat-migrate issue, which now says how to start a prep branch. - publish.yml is manual only: no release after a merge, and next-merge.mjs is gone. Release branches are made by hand. - ci.yml no longer runs for `next`, can be started by hand (publishing nothing), and `pins a stable release` applies to every PR. - The pin move accepts the SDK's own tag (upstream tags sdk/go/v0.1.7), checked with `go list -m -json` to be the release commit. Found by a dry run against 0.1.7, which every bump from now on would have hit. - Only the default token is used; UPSTREAM_BOT_TOKEN and UPSTREAM_AUTOMERGE can be deleted. - ADR 0005 gets a dated amendment; the upstream README, releasing, contributing, rules and skills docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
Simon (infra) keeps "Allow GitHub Actions to create and approve pull requests" off org-wide, and a pull request opened with the default token runs no CI. So the bump job now takes a token from the organization's bump-bot GitHub App, the same setup as sdk-go: - The job runs in the `bump-bot` environment, which only main can deploy to, and gets its token with actions/create-github-app-token from BUMP_BOT_CLIENT_ID and BUMP_BOT_PRIVATE_KEY, asked for with contents and pull requests write only. Its own GITHUB_TOKEN is read-only. - The App token reaches only the steps that list pull requests and publish, as the default token did. - No more starting CI by hand: ci.yml drops workflow_dispatch and the check-* changes that went with it, and publish.py drops the dispatch. - Every action in follow-upstream.yml is pinned by commit SHA; a test holds it to that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
This was referenced Nov 6, 2026
danreed-rh
reviewed
Nov 6, 2026
… with Two points from Dan's review of #133: - A dry run off main could not preview the bump: the one bump job needed the bump-bot environment, which only main may use. It is now two jobs. `bump` makes the commit with no secret and no environment (read-only token, pull-requests: read to list the branch's pull requests), so it runs from any ref, and hands the commit on as a git bundle. `publish-bump` runs only on main and never in a dry run, in the bump-bot environment, and builds and downloads nothing. - The commit was made from main as the run found it, so a pin that moved on main during the run could still be published backward. publish-bump now checks main out as it is, and `follow.py check-forward` refuses the bump unless its target is still ahead of main's pin. The App token is made only after that check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
danreed-rh
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Since the move to
ai-openshell, thenextsetup can't work:main's ruleset asks for a code owner's approval after the last push and dismisses stale ones.nextwas force-pushed every hour, so its approval never survived.UPSTREAM_BOT_TOKENis rejected and Follow upstream has failed every hour since the move.nextmerge both depended on the above.What changes
Follow upstream (
.github/workflows/follow-upstream.yml,deploy/ci/upstream/)bump/openshell-X.Y.Zfrommainwith one signed-off commit (pins,go.mod/go.sum, release line, README block) and opens a PR intomain.version(for example0.2.0-pre.1) makes a prep branch for a pre-release. Its PR failspins a stable releaseuntil upstream ships.compat-migrateissue, which now says how to start a prep branch.sdk-go. The job runs in abump-botenvironment that onlymaincan use, gets its token fromBUMP_BOT_CLIENT_IDandBUMP_BOT_PRIVATE_KEYwith contents and pull-requests write only, and hands it to just the two steps that list PRs and publish. Because the App opens the PR, CI runs on it normally. Allow GitHub Actions to create and approve pull requests stays off.follow-upstream.ymlis pinned by commit SHA, and a test enforces it.nextbranch.pyis replaced by the much smallerbump.py, andpublish.pyis rewritten.CI (
ci.yml)nextin the PR triggers.pins a stable releasenow runs on every PR.Releases (
publish.yml,scripts/release/)workflow_runtrigger andnext-merge.mjsare gone. Merging a bump releases nothing.Tagged SDK (
pinmove.py)sdk/go/v0.1.7), sogo getof the release commit resolves tov0.1.7, not a pseudo-version. The pin move accepts the tag only aftergo list -m -jsonconfirms it points at the release commit.Docs: a dated amendment to ADR 0005, a rewrite of
deploy/ci/upstream/README.md, and updates todocs/releasing.md,CONTRIBUTING.md,AGENTS.md,.claude/rulesand skills.Testing
python3 -m unittest discover -s deploy/ci/upstream: 266 passnode --test "scripts/**/*.test.mjs": 88 passvalidate-pins,gateway-range.mjs --check, and a YAML parse of all workflowsmainpins 0.1.6). The bump step made one commit bygithub-actions[bot]that touches onlygateway-pins.json,go.mod,go.sumandREADME.md, and its pins passvalidate-pins.publish --dry-runprinted exactly the leased push andgh pr create. Nothing was pushed. (The dry run predates the switch to the App token; the commands are the same.)Not tested: a live run on GitHub. The first scheduled run after merge should open
bump/openshell-0.1.7.Before / after merging
bump-botenvironment limited tomainholdingBUMP_BOT_CLIENT_IDandBUMP_BOT_PRIVATE_KEY. If the names differ from these, tell me and I'll change them; they're in one place in the workflow. Until it exists, thebumpjob fails; plan, check A and the report still run.UPSTREAM_BOT_TOKENsecret and theUPSTREAM_AUTOMERGEvariable.ci.yml). Merge this one first, with Rebase and merge so the stacked PR stays clean.🤖 Generated with Claude Code