From 18fda746eaadd3ef449e07756e5197b2dcfe26f6 Mon Sep 17 00:00:00 2001 From: farhan Date: Tue, 1 Sep 2026 11:39:03 +0500 Subject: [PATCH] build: align release workflow with sample-plugin standard Attach release assets via a draft `gh release create` instead of python-semantic-release/publish-action, which fails with HTTP 422 once immutable releases freeze a published release's assets. Set vcs_release: "false" so semantic-release builds and tags but leaves GitHub Release creation to us, guaranteeing dists attach before publish. Also bump python-semantic-release to v10.6.2. Mirrors openedx/sample-plugin#57. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a55ece66..b13262c1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,19 +51,38 @@ jobs: - name: Action | Semantic Version Release id: release - uses: python-semantic-release/python-semantic-release@754a065a2ea187da71977ada6630a8ec0f98e380 # v10.5.3 + uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} git_committer_name: "github-actions" git_committer_email: "actions@users.noreply.github.com" changelog: "false" - - - name: Publish | Upload to GitHub Release Assets - uses: python-semantic-release/publish-action@68eaac9f1f594e9ec4b985245d06355734f43eea # v10.5.3 + # Commit, tag, push and build, but don't create the GitHub release. + # We create it ourselves in the next step so that the distributions + # are attached before the release is published. See that step for why. + vcs_release: "false" + + # This repo has immutable releases enabled, which freezes a release's + # assets the moment it is published, so assets cannot be attached + # afterwards. `gh release create` handles this by creating the release as + # a draft, uploading the assets, and only then publishing it: + # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases + - name: Publish | Create GitHub Release with Assets if: steps.release.outputs.released == 'true' - with: - github_token: ${{ secrets.GITHUB_TOKEN }} - tag: ${{ steps.release.outputs.tag }} + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # Reuse the release notes python-semantic-release generated for us. + RELEASE_NOTES: ${{ steps.release.outputs.release_notes }} + TAG: ${{ steps.release.outputs.tag }} + run: | + # Output the release notes to a file + printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md" + # Create a draft release, upload the assets, then publish it. + gh release create "$TAG" \ + --verify-tag \ + --title "$TAG" \ + --notes-file "$RUNNER_TEMP/release_notes.md" \ + dist/* - name: Upload | Distribution Artifacts uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2