Skip to content

ci: add release-please-develop pre-release workflow #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SoulPancake wants to merge 1 commit into
base: main
Choose a base branch
from
+52 −0
Open

ci: add release-please-develop pre-release workflow #303

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions .github/workflows/release-please-develop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: release-please-develop

# Experimental / pre-release lane for the `develop` branch.
#
# This is a thin caller around the SHARED reusable workflow
# openfga/.github/.github/workflows/release-please-prerelease.yml. The common
# logic lives there so every SDK can onboard by copying just this file.
#
# It is completely separate from release-please.yml (the stable main flow):
# * targets the long-lived `develop` branch
# * only ever cuts pre-release versions (alpha/beta/rc) — enforced by the
# reusable workflow. Stable releases must go through main.
#
# Triggers:
# * workflow_dispatch → build a release PR for an explicit pre-release version
# * push to develop → when the `release:` PR merges, tag + draft + publish

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the publish claim in the trigger documentation.

The reusable workflow creates a signed tag and a draft prerelease; publishing is explicitly delegated to a later publish workflow. Update Line 16 to avoid misleading release operators. (raw.githubusercontent.com)

Proposed wording 
-#   * push to develop   → when the `release:` PR merges, tag + draft + publish
+#   * push to develop   → when the `release:` PR merges, tag + draft pre-release
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# * push to develop → when the `release:` PR merges, tag + draft + publish
# * push to develop → when the `release:` PR merges, tag + draft pre-release
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-please-develop.yml at line 16, Update the trigger
documentation comment on line 16 to state that merging the release PR creates a
signed tag and draft prerelease, while publication is handled later by the
publish workflow; remove the claim that this trigger publishes the release.

Source: MCP tools


permissions:
contents: read

on:
push:
branches: [develop]
workflow_dispatch:
inputs:
release-version:
description: >
Explicit pre-release version to cut (e.g. 0.10.0-beta.1, 0.10.0-rc.2).
Must include an alpha/beta/rc suffix. Stable versions are rejected.
required: true
type: string

jobs:
prerelease:
permissions:
contents: write
pull-requests: write
if: |
github.event_name == 'workflow_dispatch' ||
startsWith(github.event.head_commit.message, 'release:')
uses: openfga/.github/.github/workflows/release-please-prerelease.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
with:
trigger-event: ${{ github.event_name }}
release-version: ${{ inputs.release-version || '' }}

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' |
  rg -n 'inputs\.release-version|VERSION='

Repository: openfga/python-sdk

Length of output: 321

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Workflow files =="
fd -a 'release-please.*\.ya?ml|release.*\.ya?ml' .github/workflows 2>/dev/null | sed 's#^\./##' | sort

echo
echo "== Caller workflow excerpt =="
if [ -f .github/workflows/release-please-develop.yml ]; then
  nl -ba .github/workflows/release-please-develop.yml | sed -n '1,90p'
fi

echo
echo "== Reusable workflow excerpts around release-version =="
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' > /tmp/release-prerelease.yml
nl -ba /tmp/release-prerelease.yml | sed -n '45,75p'
echo "---"
nl -ba /tmp/release-prerelease.yml | sed -n '125,148p'
echo "---"
nl -ba /tmp/release-prerelease.yml | sed -n '250,275p'

echo
echo "== Search all local workflow uses =="
rg -n "release-version|release-please-prerelease|uses:" .github/workflows || true

Repository: openfga/python-sdk

Length of output: 369

🌐 Web query:

GitHub Actions reusable workflow inputs passed to shell steps injection security

💡 Result:

When passing inputs to a reusable workflow, direct interpolation of these inputs into shell commands via ${{ inputs.x }} expression syntax creates a critical risk of shell command injection [1][2][3]. Because the ${{ }} syntax is expanded by GitHub Actions before the shell interprets the command, an attacker can supply malicious characters (such as ;, &&, or |) to break out of the intended command context and execute arbitrary code on the runner [1][2][3]. To secure reusable workflows against this vulnerability, implement the following defensive strategies: Use Environment Variable Indirection (Primary Defense) Never use the ${{ inputs.x }} syntax directly inside a run step [4][5]. Instead, assign the input to an environment variable in the env block of the step and reference that variable within your shell command [6][2][4][3]. By using variable expansion within the shell (e.g., "$MY_VAR"), the input is treated as data rather than executable code [4][5]. Example of vulnerable code: - run:./deploy.sh ${{ inputs.environment }} Example of secure code: - name: Deploy env: ENVIRONMENT: ${{ inputs.environment }} run:./deploy.sh "$ENVIRONMENT" Implement Input Validation Treat all reusable workflow inputs as untrusted, especially if they originate from user-controlled triggers [6][4][5]. Implement validation steps—such as regex checks or allowlists—at the beginning of your workflow to ensure the input conforms to expected formats before it is used in any downstream logic [6][3]. Apply Principle of Least Privilege Reusable workflows inherit the GITHUB_TOKEN permissions of the caller [6]. If an injection occurs, an attacker may leverage these permissions to modify repository contents or exfiltrate secrets [6][2][5]. Always set explicit, minimal permissions for the workflow using the permissions key, and prefer explicit secret passing over the secrets: inherit keyword to limit the scope of accessible secrets [6][5][7]. Automate Security Checks Incorporate security scanning tools to detect unsafe input interpolation automatically [2][4]. Tools such as CodeQL, actionlint, and zizmor can identify potential injection points during development and prevent vulnerable workflows from being merged or executed [4][5][7].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
IFS=$'\n'

echo "== Caller workflow excerpt =="
if [ -f .github/workflows/release-please-develop.yml ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/release-please-develop.yml | sed -n '1,90p'
fi

echo
echo "== Reusable workflow excerpts around release-version =="
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' > /tmp/release-prerelease.yml
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '55,70p'
echo "---"
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '125,148p'
echo "---"
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '250,275p'

echo
echo "== Search all local workflow uses =="
rg -n "release-version|release-please-prerelease|workflow_dispatch|on:" .github/workflows || true

Repository: openfga/python-sdk

Length of output: 8305

Use shell-safe input assignment in the reusable workflow before enabling this input.

This passes the workflow_dispatch.release-version input to a pinned reusable workflow whose workflow_dispatch branch interpolates ${{ inputs.release-version }} directly into shell assignments at the lines that validate and commit the requested version. A value containing shell metacharacters can execute before the pre-release regex check, so assign the input via env: first, validate the environment variable, and update the caller pin after the reusable workflow is fixed.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-please-develop.yml at line 44, Update the reusable
workflow’s workflow_dispatch handling to pass release-version through an env
variable before any shell assignment, validate that environment variable with
the pre-release regex, and use it for validation and commit operations. Then
update the caller’s pinned reusable-workflow reference in
release-please-develop.yml so it points to the fixed revision.

Source: MCP tools

base-branch: develop
staging-branch: release-develop
secrets:
RELEASER_APP_CLIENT_ID: ${{ secrets.RELEASER_APP_CLIENT_ID }}
RELEASER_APP_PRIVATE_KEY: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

Loading