2bfc5334eb
- Decouple draft-promotion.yml from automated Tests workflow_run triggers, making promotion draft creation manual via workflow_dispatch to prevent GitHub from auto-chaining active experimental feature PRs into a stack targeting main. - Enforce and document the mandatory Promotion Merge Policy across reconcile_promotion_pr.py, validate_release_candidate.py, and draft-promotion.yml step summary: promotions must use a merge commit (--no-ff) or fast-forward, never squash-merge into main, preserving conventional commit history and unbroken git ancestry. - Unhide refactor commits in release-please-config.json so architectural refactorings are tracked under Changed in CHANGELOG.md. - Update unit tests in test_reconcile_promotion_pr.py and test_validate_release_candidate.py for the new policy invariants. Signed-off-by: trvon <me@trevon.dev>
49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
# Draft visibility is deliberately separate from candidate validation and release authority.
|
|
name: Draft Promotion
|
|
|
|
"on":
|
|
workflow_dispatch: {}
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: draft-promotion-experimental-main
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
reconcile:
|
|
if: github.repository == 'trvon/yams' && github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
steps:
|
|
- name: Checkout immutable main-owned tooling only
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
ref: ${{ github.workflow_sha }}
|
|
fetch-depth: 1
|
|
persist-credentials: false
|
|
submodules: false
|
|
|
|
- name: Reconcile draft visibility (never promotion)
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: python3 scripts/ci/reconcile_promotion_pr.py --apply
|
|
|
|
- name: Explain delivery boundaries
|
|
if: always()
|
|
run: |
|
|
{
|
|
echo '## Draft visibility only'
|
|
echo 'Existing PR text and state are never updated; the initial snapshot may age.'
|
|
echo 'No ready-for-review, merge, version change, tag, release, or publication is authorized.'
|
|
echo 'GITHUB_TOKEN PR creation does not trigger normal PR-opened checks.'
|
|
echo 'A maintainer must verify current-head checks and close/reopen the PR with their own account if needed.'
|
|
echo 'If PR creation is denied, a maintainer must approve repository Actions PR-creation settings; this job never changes them.'
|
|
echo ''
|
|
echo '### Promotion Merge Policy Reminder'
|
|
echo 'Promotions from experimental to main must use "Create a merge commit" (git merge --no-ff) or fast-forward.'
|
|
echo 'NEVER use "Squash and merge" into main.'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|