chore(release): use protoLabsAI/release-tools@v1 for release notes#3650
Merged
Conversation
Replaces the local fork of \`scripts/rewrite-release-notes.mjs\` (210 LOC) with the upstream composite Action at \`protoLabsAI/release-tools@v1\`. The local script was a stale copy of the same logic already centralized in the release-tools repo — exactly the consolidation pattern we want. Side benefit: switches release-notes generation from a direct \`ANTHROPIC_API_KEY\` call to the protoLabs LLM gateway (default model \`protolabs/fast\`), matching the rest of the agent stack. Removes one more place we hand out raw Anthropic keys. Notes: - The composite Action's secret naming is \`DISCORD_RELEASE_WEBHOOK\` but our existing secret is \`DISCORD_DEV_WEBHOOK\`. We pass our secret via the env-var mapping so we don't need a new repo secret. - Already-consumed elsewhere: \`code-review.yml\` uses \`npx -p github:protoLabsAI/release-tools review-code\`. This PR brings \`auto-release.yml\` into line. Future consolidation opportunities for release-tools (not blocking this PR): - The "Pre-flight: format/lint/typecheck" pattern in \`checks.yml\` could become a reusable workflow. - The "setup-node + install + build packages" pattern in \`pr-check.yml\` could become a composite action. - \`scripts/post-review-findings.mjs\` (86 LOC) duplicates a "post sticky PR comment" pattern that could live in release-tools alongside \`review-code\`. Docs updated to reflect the new entry points (\`docs/self-hosting/ci-cd.md\`, \`docs/internal/dev/release.md\`, \`docs/internal/dev/versioning.md\`). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR migrates release notes generation from a local script to a centralized ChangesRelease Notes Tool Centralization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Review — ? finding(s)
protoLabs Code Review Report
No findings recorded. |
Contributor
This was referenced May 24, 2026
![protoquinn[bot]](https://avatars.githubusercontent.com/in/3282126?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
docs/self-hosting/ci-cd.md (2)
283-290:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate secrets table to reflect gateway credentials.
The secrets table lists
ANTHROPIC_API_KEY, but the workflow now usesGATEWAY_API_KEY(line 111 in auto-release.yml). Additionally,DISCORD_DEV_WEBHOOKis mapped toDISCORD_RELEASE_WEBHOOKin the Action inputs.📝 Proposed fix
## Secrets -| Secret | Purpose | -| ------------------- | -------------------------------------------------------------------------- | -| `GITHUB_TOKEN` | Auto-provided, used for releases | -| `GH_PAT` | PAT for `auto-release.yml` tag push (enables downstream workflow triggers) | -| `ANTHROPIC_API_KEY` | LLM release notes rewriting (Haiku 4.5) | +| Secret | Purpose | +| ----------------------- | -------------------------------------------------------------------------- | +| `GITHUB_TOKEN` | Auto-provided, used for releases | +| `GH_PAT` | PAT for `auto-release.yml` tag push (enables downstream workflow triggers) | +| `GATEWAY_API_KEY` | LiteLLM gateway access for release notes rewriting and code review | +| `GATEWAY_BASE_URL` | LiteLLM gateway base URL (optional, has default) | +| `DISCORD_DEV_WEBHOOK` | Discord webhook for release notes and dev notifications |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/self-hosting/ci-cd.md` around lines 283 - 290, Update the Secrets table to match the actual Action inputs: replace or add the `GATEWAY_API_KEY` entry (used in auto-release.yml) instead of `ANTHROPIC_API_KEY`, and add/mirror the webhook secret mapping by listing `DISCORD_DEV_WEBHOOK` → `DISCORD_RELEASE_WEBHOOK` (or rename to `DISCORD_RELEASE_WEBHOOK`) so the docs match the workflow's inputs referenced in `auto-release.yml` and the Action input mapping.
203-237:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate requirements to reflect gateway-based authentication.
Line 237 lists
ANTHROPIC_API_KEYas required, but the workflow at.github/workflows/auto-release.ymlline 111 now usesGATEWAY_API_KEYto route through the LiteLLM gateway. The overview section should also mention that the centralized tool uses the gateway rather than direct Anthropic API access.📝 Proposed fix
## Release Notes Rewriting -An LLM-powered release notes rewriter transforms raw conventional commits into polished, user-facing release notes. Centralized in [`@protolabsai/release-tools`](https://github.com/protoLabsAI/release-tools) — exposed as both a composite GitHub Action (`protoLabsAI/release-tools@v1`) and an npm CLI (`npx `@protolabsai/release-tools` rewrite-release-notes`). +An LLM-powered release notes rewriter transforms raw conventional commits into polished, user-facing release notes. Centralized in [`@protolabsai/release-tools`](https://github.com/protoLabsAI/release-tools) — exposed as both a composite GitHub Action (`protoLabsAI/release-tools@v1`) and an npm CLI (`npx `@protolabsai/release-tools` rewrite-release-notes`). The tool routes requests through the protoLabs LiteLLM gateway rather than calling Anthropic directly. ### How It Works 1. Fetches commits between two git tags via `git log` 2. Filters out merge, chore, and promote commits -3. Sends the remaining commits to Claude (Haiku 4.5) with a system prompt enforcing brand voice +3. Sends the remaining commits to the LiteLLM gateway (defaults to `protolabs/fast` model) with a system prompt enforcing brand voice 4. Returns themed, grouped release notes in plain markdown 5. Optionally posts to Discord `#dev` as an embed ### Requirements -- `ANTHROPIC_API_KEY` — required for Claude API calls +- `GATEWAY_API_KEY` — required for LiteLLM gateway access +- `GATEWAY_BASE_URL` — optional, defaults to protoLabs gateway - Git tags must exist locally (`git fetch origin --tags` if needed)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/self-hosting/ci-cd.md` around lines 203 - 237, Update the requirements and overview to reflect gateway-based auth: replace the mention of ANTHROPIC_API_KEY with GATEWAY_API_KEY and state that `@protolabsai/release-tools` (the rewrite-release-notes CLI / protoLabsAI/release-tools GitHub Action) uses the LiteLLM gateway for requests rather than direct Anthropic API access; also add a short note referencing the workflow auto-release.yml (the "Rewrite and post release notes to Discord" step) as using GATEWAY_API_KEY so readers know which env var to set.docs/internal/dev/release.md (3)
64-68:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate environment variables to match the workflow implementation.
The documentation lists
ANTHROPIC_API_KEYas required, but the workflow at.github/workflows/auto-release.ymlline 111 now usesGATEWAY_API_KEY. This inconsistency will confuse users trying to configure the release-tools manually.📝 Proposed fix
### Environment Variables -| Variable | Required | Description | -| ------------------- | -------- | ---------------------------------- | -| `ANTHROPIC_API_KEY` | Yes | Anthropic API key for Claude calls | +| Variable | Required | Description | +| ------------------ | -------- | ---------------------------------------------- | +| `GATEWAY_API_KEY` | Yes | LiteLLM gateway API key for model calls | +| `GATEWAY_BASE_URL` | No | Gateway base URL (defaults to protoLabs gateway) |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/internal/dev/release.md` around lines 64 - 68, The docs list ANTHROPIC_API_KEY as required but the release workflow actually uses GATEWAY_API_KEY; update the Environment Variables table in docs/internal/dev/release.md to reflect the workflow by replacing or adding GATEWAY_API_KEY as the required variable (and remove or mark ANTHROPIC_API_KEY as optional/legacy), and ensure the Description clearly states it is the API key used by the auto-release workflow (match the name used in .github/workflows/auto-release.yml).
132-137:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate manual run instructions to use gateway credentials.
Line 136 instructs users to set
ANTHROPIC_API_KEYfor manual runs, but the centralized tool usesGATEWAY_API_KEYto route through the LiteLLM gateway.📝 Proposed fix
### Enabling/Disabling - **Enabled by default**: Wired into `auto-release.yml` — runs on every push to `main` -- **Requires**: `ANTHROPIC_API_KEY` (Claude API) -- **Manual runs**: `npx `@protolabsai/release-tools` rewrite-release-notes` locally with `ANTHROPIC_API_KEY` set +- **Requires**: `GATEWAY_API_KEY` (LiteLLM gateway access) +- **Manual runs**: `npx `@protolabsai/release-tools` rewrite-release-notes` locally with `GATEWAY_API_KEY` and optionally `GATEWAY_BASE_URL` set - **Disable in CI**: Remove or comment out the "Rewrite and post release notes" step in `auto-release.yml`; the GitHub Release body still contains the raw auto-generated notes from `gh release create`🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/internal/dev/release.md` around lines 132 - 137, Update the manual-run instruction to tell users to set the gateway credential instead of the direct Claude key: replace the reference to ANTHROPIC_API_KEY with GATEWAY_API_KEY in the "Manual runs" bullet so it reads that running npx `@protolabsai/release-tools` rewrite-release-notes should be executed locally with GATEWAY_API_KEY set (the gateway will route to the Claude backend); keep the rest of the sentence intact and ensure the note still clarifies this is for local/manual runs.
118-130:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate CI integration example to match the workflow implementation.
The CI integration example still references
ANTHROPIC_API_KEY, but the actual workflow usesGATEWAY_API_KEY. Additionally, the example shows arun:script withnpx, but the actual workflow (lines 106-112) uses the composite Action withuses:.📝 Proposed fix to match auto-release.yml implementation
## CI Integration The `auto-release.yml` workflow calls the rewriter script as the final step after creating the GitHub Release. The step auto-detects the previous tag and passes both versions to the script: ```yaml -- name: Rewrite and post release notes to Discord - run: | - VERSION="v${{ steps.version.outputs.version }}" - PREV_TAG=$(git tag --sort=-v:refname | grep -v "^${VERSION}$" | head -1) - npx `@protolabsai/release-tools` rewrite-release-notes "$VERSION" "$PREV_TAG" --post-discord +- name: Resolve previous tag + id: prev + run: | + VERSION="v${{ steps.version.outputs.version }}" + PREV_TAG=$(git tag --sort=-v:refname | grep -v "^${VERSION}$" | head -1) + echo "tag=$PREV_TAG" >> $GITHUB_OUTPUT + +- name: Rewrite and post release notes to Discord + uses: protoLabsAI/release-tools@v1 + with: + version: v${{ steps.version.outputs.version }} + previous-version: ${{ steps.prev.outputs.tag }} env: - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + GATEWAY_API_KEY: ${{ secrets.GATEWAY_API_KEY }} + DISCORD_RELEASE_WEBHOOK: ${{ secrets.DISCORD_DEV_WEBHOOK }}</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.In
@docs/internal/dev/release.mdaround lines 118 - 130, Update the CI example
in docs/internal/dev/release.md to match the actual workflow: replace the
run:npx block with a two-step sequence — first add a "Resolve previous tag" step
(id: prev) that sets VERSION="v${{ steps.version.outputs.version }}" and writes
PREV_TAG to GITHUB_OUTPUT as tag, then use the composite action "uses:
protoLabsAI/release-tools@v1" for the "Rewrite and post release notes to
Discord" step with inputs version: v${{ steps.version.outputs.version }} and
previous-version: ${{ steps.prev.outputs.tag }}; also replace the env secret
ANTHROPIC_API_KEY with GATEWAY_API_KEY and add DISCORD_RELEASE_WEBHOOK as shown.</details> </blockquote></details> </blockquote></details>🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Inline comments: In @.github/workflows/auto-release.yml: - Line 106: The workflow is using the mutable tag protoLabsAI/release-tools@v1 which is a supply-chain risk; update the step that currently says "uses: protoLabsAI/release-tools@v1" to pin to the exact commit SHA for that v1 release (e.g., protoLabsAI/release-tools@<commit-sha>). Find the v1 branch/tag in the protoLabsAI/release-tools repository, copy the commit SHA for the intended v1 release, and replace the mutable tag with that SHA so the action is pinned to a specific immutable revision. --- Outside diff comments: In `@docs/internal/dev/release.md`: - Around line 64-68: The docs list ANTHROPIC_API_KEY as required but the release workflow actually uses GATEWAY_API_KEY; update the Environment Variables table in docs/internal/dev/release.md to reflect the workflow by replacing or adding GATEWAY_API_KEY as the required variable (and remove or mark ANTHROPIC_API_KEY as optional/legacy), and ensure the Description clearly states it is the API key used by the auto-release workflow (match the name used in .github/workflows/auto-release.yml). - Around line 132-137: Update the manual-run instruction to tell users to set the gateway credential instead of the direct Claude key: replace the reference to ANTHROPIC_API_KEY with GATEWAY_API_KEY in the "Manual runs" bullet so it reads that running npx `@protolabsai/release-tools` rewrite-release-notes should be executed locally with GATEWAY_API_KEY set (the gateway will route to the Claude backend); keep the rest of the sentence intact and ensure the note still clarifies this is for local/manual runs. - Around line 118-130: Update the CI example in docs/internal/dev/release.md to match the actual workflow: replace the run:npx block with a two-step sequence — first add a "Resolve previous tag" step (id: prev) that sets VERSION="v${{ steps.version.outputs.version }}" and writes PREV_TAG to GITHUB_OUTPUT as tag, then use the composite action "uses: protoLabsAI/release-tools@v1" for the "Rewrite and post release notes to Discord" step with inputs version: v${{ steps.version.outputs.version }} and previous-version: ${{ steps.prev.outputs.tag }}; also replace the env secret ANTHROPIC_API_KEY with GATEWAY_API_KEY and add DISCORD_RELEASE_WEBHOOK as shown. In `@docs/self-hosting/ci-cd.md`: - Around line 283-290: Update the Secrets table to match the actual Action inputs: replace or add the `GATEWAY_API_KEY` entry (used in auto-release.yml) instead of `ANTHROPIC_API_KEY`, and add/mirror the webhook secret mapping by listing `DISCORD_DEV_WEBHOOK` → `DISCORD_RELEASE_WEBHOOK` (or rename to `DISCORD_RELEASE_WEBHOOK`) so the docs match the workflow's inputs referenced in `auto-release.yml` and the Action input mapping. - Around line 203-237: Update the requirements and overview to reflect gateway-based auth: replace the mention of ANTHROPIC_API_KEY with GATEWAY_API_KEY and state that `@protolabsai/release-tools` (the rewrite-release-notes CLI / protoLabsAI/release-tools GitHub Action) uses the LiteLLM gateway for requests rather than direct Anthropic API access; also add a short note referencing the workflow auto-release.yml (the "Rewrite and post release notes to Discord" step) as using GATEWAY_API_KEY so readers know which env var to set.🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID:
01c5a064-59ae-4942-a94e-c910d8800a6e📒 Files selected for processing (5)
.github/workflows/auto-release.ymldocs/internal/dev/release.mddocs/internal/dev/versioning.mddocs/self-hosting/ci-cd.mdscripts/rewrite-release-notes.mjs💤 Files with no reviewable changes (1)
- scripts/rewrite-release-notes.mjs
| - name: Rewrite and post release notes to Discord | ||
| if: steps.version.outputs.already_tagged != 'true' && env.DISCORD_DEV_WEBHOOK != '' | ||
| continue-on-error: true | ||
| uses: protoLabsAI/release-tools@v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Fetch the commit SHA for the v1 tag of protoLabsAI/release-tools
gh api repos/protoLabsAI/release-tools/git/ref/tags/v1 --jq '.object.sha'Repository: protoLabsAI/protoMaker
Length of output: 107
Pin protoLabsAI/release-tools@v1 to a commit SHA in .github/workflows/auto-release.yml.
uses: protoLabsAI/release-tools@v1 is a mutable tag; pinning to the tag’s current commit reduces supply-chain risk.
🔒 Proposed fix
- uses: protoLabsAI/release-tools@v1
+ uses: protoLabsAI/release-tools@79261c2b99472596cd5452e9ec1fd5c9648c12a6 # v1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| uses: protoLabsAI/release-tools@v1 | |
| uses: protoLabsAI/release-tools@79261c2b99472596cd5452e9ec1fd5c9648c12a6 # v1 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 106-106: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-release.yml at line 106, The workflow is using the
mutable tag protoLabsAI/release-tools@v1 which is a supply-chain risk; update
the step that currently says "uses: protoLabsAI/release-tools@v1" to pin to the
exact commit SHA for that v1 release (e.g.,
protoLabsAI/release-tools@<commit-sha>). Find the v1 branch/tag in the
protoLabsAI/release-tools repository, copy the commit SHA for the intended v1
release, and replace the mutable tag with that SHA so the action is pinned to a
specific immutable revision.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the local fork of `scripts/rewrite-release-notes.mjs` (210 LOC) with the upstream composite Action at `protoLabsAI/release-tools@v1`. The local script was a stale copy of the same logic already centralized in the release-tools repo — exactly the consolidation pattern we want.
Why
What changes
Existing repo secrets reused — no new secrets required. `DISCORD_DEV_WEBHOOK` is passed through the env-var mapping as `DISCORD_RELEASE_WEBHOOK` (the name the upstream Action expects).
Future consolidation opportunities
These would push more shared logic to release-tools so other protoLabs repos benefit:
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores