Repository navigation
ci: merge-and-auto-release workflow (draft-release approval) #34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Carl723000
merged 2 commits into
ClaudeCodeUsage:main
from
nickearnshaw:ci/merge-and-auto-release
Jun 15, 2026
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Release Drafter config. | ||
| # | ||
| # Keeps a single DRAFT GitHub Release continuously up to date as PRs merge to | ||
| # main. The maintainer reviews that draft and clicks "Publish" to ship — which | ||
| # creates the tag and triggers publish.yml. Nothing publishes automatically. | ||
| # | ||
| # The next version is inferred from the labels on the merged PRs: | ||
| # major → "breaking" minor → "feature"/"enhancement" | ||
| # patch → everything else (the default) | ||
| # | ||
| # A version label is set by the maintainer when they merge (the PR template shows | ||
| # the mapping; unlabeled defaults to patch). The `autolabeler` block below is | ||
| # kept ready but only runs if a pull_request trigger is added to the workflow — | ||
| # see the note in .github/workflows/release-drafter.yml. | ||
|
|
||
| name-template: 'v$RESOLVED_VERSION' | ||
| tag-template: 'v$RESOLVED_VERSION' | ||
|
|
||
| categories: | ||
| - title: '✨ Features' | ||
| labels: ['feature', 'enhancement'] | ||
| - title: '🐛 Fixes' | ||
| labels: ['fix', 'bug'] | ||
| - title: '📝 Docs / CI / chore' | ||
| labels: ['docs', 'ci', 'chore', 'dependencies'] | ||
|
|
||
| change-template: '- $TITLE (#$NUMBER) @$AUTHOR' | ||
| change-title-escapes: '\<*_&' | ||
|
|
||
| version-resolver: | ||
| major: | ||
| labels: ['breaking', 'major'] | ||
| minor: | ||
| labels: ['feature', 'enhancement', 'minor'] | ||
| patch: | ||
| labels: ['fix', 'bug', 'docs', 'ci', 'chore', 'dependencies', 'patch'] | ||
| default: patch | ||
|
|
||
| # Apply a label from the branch name or a conventional-commit-style title prefix. | ||
| autolabeler: | ||
| - label: 'breaking' | ||
| title: ['/!:/', '/^[a-z]+(\(.+\))?!:/i'] | ||
| - label: 'feature' | ||
| branch: ['/^feat(ure)?\//'] | ||
| title: ['/^feat(\(.+\))?:/i'] | ||
| - label: 'fix' | ||
| branch: ['/^(fix|bugfix|hotfix)\//'] | ||
| title: ['/^fix(\(.+\))?:/i'] | ||
| - label: 'docs' | ||
| branch: ['/^docs?\//'] | ||
| title: ['/^docs(\(.+\))?:/i'] | ||
| - label: 'ci' | ||
| branch: ['/^ci\//'] | ||
| title: ['/^ci(\(.+\))?:/i'] | ||
| - label: 'chore' | ||
| branch: ['/^chore\//'] | ||
| title: ['/^chore(\(.+\))?:/i'] | ||
|
|
||
| template: | | ||
| ## What's changed | ||
|
|
||
| $CHANGES | ||
|
|
||
| **Contributors:** $CONTRIBUTORS | ||
| **Full changelog:** https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Drafts the next GitHub Release as changes land on main. | ||
| # | ||
| # On every push to main, release-drafter (re)builds a single DRAFT Release with | ||
| # categorised notes and the next semver version inferred from the merged PRs' | ||
| # labels (config in .github/release-drafter.yml). Nothing is published here — the | ||
| # maintainer reviews the draft and clicks "Publish release" when ready, which | ||
| # creates the tag and triggers publish.yml. | ||
| # | ||
| # Why push-to-main only (no pull_request trigger): Release Drafter reads its | ||
| # config from the *default* branch, and GitHub forces the default GITHUB_TOKEN | ||
| # read-only for PRs opened from forks — so a pull_request autolabeler couldn't | ||
| # label external contributions anyway. Maintainers set the version label when | ||
| # they merge (the PR template shows the mapping; unlabeled defaults to patch). | ||
| # To enable branch/title autolabeling for same-repo PRs later, add a | ||
| # `pull_request_target` trigger plus `pull-requests: write`. | ||
|
|
||
| name: Release Drafter | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| update_release_draft: | ||
| permissions: | ||
| contents: write # create / update the draft release | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: release-drafter/release-drafter@v6 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi, thank you for addressing this issue.
As a security engineer, I totally support this change.
In the same line, please make sure that the commit is pinned instead of attached to a version such as @v6
Should
release-drafter/release-drafterbe compromised and publish a new evil release e.g.v6.6.6. You are compromised by supply chain.If you pin the commit instead you won't be impacted.