ci: add release-please-develop pre-release workflow - #734
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow to support a pre-release lane from the develop branch, delegating the actual release logic to the shared openfga/.github reusable workflow (pinned by SHA) to keep implementation consistent across SDK repos.
Changes:
- Introduces
.github/workflows/release-please-develop.ymlto generate/publish pre-releases fromdevelop. - Supports both
workflow_dispatch(explicit pre-release version input) andpushtodevelopgated onrelease:-prefixed merge commits. - Configures job-level permissions and passes expected inputs (
base-branch,staging-branch,trigger-event) to the reusable workflow.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
WalkthroughAdds a GitHub Actions workflow that runs prerelease automation for ChangesDevelop prerelease automation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-please-develop.yml:
- Around line 26-31: Update the reusable workflow’s release-version handling so
the workflow input is passed through an environment variable and validated
before use, rather than interpolated into the parse-release.sh invocation or
commit commands. Preserve the required alpha/beta/rc format validation, use the
validated value safely in shell steps, and update the referenced commit pin to
include this fix.
- Around line 14-16: Update the trigger comments near the reusable prerelease
workflow to clarify that it creates the signed tag and draft release, while
publication is performed downstream by a separate workflow; do not describe this
workflow as publishing the release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b34fa4bb-4de8-4dc4-bc35-67d9a321bdac
📒 Files selected for processing (1)
.github/workflows/release-please-develop.yml
| # Triggers: | ||
| # * workflow_dispatch → build a release PR for an explicit pre-release version | ||
| # * push to develop → when the `release:` PR merges, tag + draft + publish |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate workflow files =="
git ls-files .github/workflows | sed -n '1,120p'
echo
echo "== target workflow =="
cat -n .github/workflows/release-please-develop.yml
echo
echo "== related release workflow lines =="
for f in .github/workflows/release-please-prerelease.yml .github/workflows/*.yml; do
if [ -f "$f" ]; then
echo "--- $f (release/publish references) ---"
rg -n "release-please-prerelease|publish|draft|tag|workflow_run|workflow_dispatch|develop|release:" "$f" || true
fi
done
echo
echo "== git diff stat/name =="
git diff --stat HEAD~1...HEAD 2>/_dev/null || git diff --stat 2>/dev/null || true
git diff -- .github/workflows/release-please-develop.yml 2>/dev/null || trueRepository: openfga/cli
Length of output: 4414
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== parse reusable workflow trigger/calls =="
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/release-please-prerelease.yml")
print(f"exists={p.exists()}")
if p.exists():
text = p.read_text()
for i,line in enumerate(text.splitlines(),1):
if "on:" in line or "release-please" in line or "workflow_dispatch" in line or "workflow_run" in line or "push to" in line:
print(f"{i}: {line}")
PY
echo
echo "== parse develop workflow call =="
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/release-please-develop.yml")
print(f"exists={p.exists()}")
if p.exists():
for i,line in enumerate(p.read_text().splitlines(),1):
if "uses:" in line or "on:" in line or "push" in line or "workflow_dispatch" in line or "release:" in line:
print(f"{i}: {line}")
PYRepository: openfga/cli
Length of output: 852
🌐 Web query:
openfga .github release-please-prerelease.yml workflow publish draft tag
💡 Result:
The release-please-prerelease.yml workflow within the openfga/.github repository is a reusable workflow designed to handle pre-release (alpha/beta/rc) versions for OpenFGA SDKs and components [1]. Key insights regarding the use of draft releases and tag creation with release-please are as follows: 1. Draft Releases and Tagging: By default, GitHub does not create a Git tag for draft releases [2][3]. This can cause issues for release-please because it relies on previous tags to calculate version bumps and generate changelogs [2][3]. 2. Handling Tag Creation: To address the lack of a tag when using draft: true, release-please provides a configuration option called --force-tag-creation (or equivalent in the action configuration) [3]. Enabling this ensures that a Git tag is created immediately, even if the release is marked as a draft [3]. 3. Common Workaround: If you are not using --force-tag-creation, a common manual workaround to avoid errors in subsequent release-please runs is to temporarily set draft: false to force the tag creation, and then immediately convert the release back to a draft using the GitHub CLI [2]: - name: Convert to Draft if: ${{ steps.release.outputs.release_created }} run: gh release edit "$TAG" --draft=true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ steps.release.outputs.tag_name }} 4. OpenFGA Implementation: The release-please-prerelease.yml in openfga/.github was specifically created to provide a dedicated "pre-release lane" that mirrors the main release-please machinery without impacting stable releases on the main branch [1][4]. It allows for parameterized base branches to facilitate versioning from long-lived development branches [1]. When integrating this, it is recommended to reference the reusable workflow using an immutable commit SHA rather than a mutable tag like @main to prevent unexpected behavior due to workflow updates [4].
Citations:
- 1: openfga/.github@835baf3
- 2:
Invalid previous_tag parametererror when usingdraft: true— tag not created for draft release googleapis/release-please#2798 - 3: https://github.com/googleapis/release-please/blob/main/docs/cli.md
- 4: chore(ci): add pre-release lane on develop branch js-sdk#440
Clarify that publishing is downstream.
This workflow only calls the reusable prerelease workflow, which creates the signed tag and draft release; publication is handled by a separate workflow.
Suggested wording
-# * push to develop → when the `release:` PR merges, tag + draft + publish
+# * push to develop → when the `release:` PR merges, tag + draft
+# (publishing is handled by the downstream workflow)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Triggers: | |
| # * workflow_dispatch → build a release PR for an explicit pre-release version | |
| # * push to develop → when the `release:` PR merges, tag + draft + publish | |
| # Triggers: | |
| # * workflow_dispatch → build a release PR for an explicit pre-release version | |
| # * push to develop → when the `release:` PR merges, tag + draft | |
| # (publishing is handled by the downstream workflow) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-please-develop.yml around lines 14 - 16, Update
the trigger comments near the reusable prerelease workflow to clarify that it
creates the signed tag and draft release, while publication is performed
downstream by a separate workflow; do not describe this workflow as publishing
the release.
| release-version: | ||
| description: > | ||
| Explicit pre-release version to cut (e.g. 0.10.0-beta.1, 0.10.0-rc.2). | ||
| Must include an alpha/beta/rc suffix. Stable versions are rejected. | ||
| required: true | ||
| type: string |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
cat -n .github/workflows/release-please-develop.yml
echo
echo "== find referenced reusable workflow =="
rg -n "release-please-prerelease|actions/checkout|uses:.*\\.github/workflows" .github/workflows/release-please-develop.yml .github/workflows || trueRepository: openfga/cli
Length of output: 4808
🌐 Web query:
raw.githubusercontent.com openfga .github 835baf31562809ad9eb884c73efc5b79318f700f .github/workflows/release-please-prerelease.yml
💡 Result:
The file.github/workflows/release-please-prerelease.yml in the openfga/.github repository (referenced at commit 835baf3) is a shared, reusable GitHub Actions workflow designed to automate the creation of pre-release versions (such as alpha, beta, or release candidates) [1]. Key characteristics of this workflow include: Purpose: It provides a dedicated "pre-release lane" for cutting non-stable versions from long-lived development branches (e.g., develop) without interfering with the stable release processes managed by the standard release-please.yml workflow on the main branch [1][2]. Mechanism: It mirrors the functionality of the standard release-please workflow but is specifically configured for pre-releases [1]. It is designed to be parameterized by base and staging branches, allowing various OpenFGA SDKs and repositories to onboard it easily as a thin caller [1]. Implementation: The workflow supports conventional commits and automates tasks such as creating draft pre-releases and GPG-signed tags [2][3]. It enables development teams to test release candidates without disrupting stable release lanes [2]. This reusable workflow was introduced to allow for a promotion model where pre-releases are generated from development branches, while stable releases continue to be managed strictly through the main branch [2].
Citations:
- 1: openfga/.github@835baf3
- 2: chore(ci): add pre-release lane on develop branch js-sdk#440
- 3: openfga/js-sdk@5fb550d
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== fetch pinned reusable workflow =="
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' | cat -n
echo
echo "== direct shell invariance probe for quoted version interpolation =="
python3 - <<'PY'
version = '" echo "PWNED" # not a version'
run = f'echo "Version: {version}"'
print(run)
PYRepository: openfga/cli
Length of output: 16195
Do not interpolate release-version into shell source.
At .github/workflows/release-please-develop.yml:41-44, a workflow_dispatch payload reaches the reusable workflow, which currently expands it directly into run: scripts (bash .shared-ci/.github/workflows/scripts/parse-release.sh ... / commit commands) before validation. A crafted value can break out of the shell command and execute in a job with write permissions and release secrets. Change the reusable workflow to receive it through env, validate it there, then update this commit pin accordingly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-please-develop.yml around lines 26 - 31, Update
the reusable workflow’s release-version handling so the workflow input is passed
through an environment variable and validated before use, rather than
interpolated into the parse-release.sh invocation or commit commands. Preserve
the required alpha/beta/rc format validation, use the validated value safely in
shell steps, and update the referenced commit pin to include this fix.
Adds a
release-please-developworkflow enabling pre-release (alpha/beta/rc) releases from thedevelopbranch, viaworkflow_dispatchor on merge of arelease:PR. It is a thin caller around the sharedopenfga/.githubreusablerelease-please-prerelease.yml, mirroring the existingrelease-pleasemain flow.Reference: https://github.com/openfga/js-sdk/blob/main/.github/workflows/release-please-develop.yml
Summary by CodeRabbit