feat(release): release on merge to the trunk, not on a tag

Implements the approved publishing policy (.github-config#17) in the
shared workflows:

- release-check runs on the trunk only, reads the version from the
  merged manifest, and reports release=false when that version already
  has a GitHub release, so a push that keeps the version publishes
  nothing. The new manifest.py release command refuses prerelease
  versions, a Helm chart that disagrees with the manifest, and git
  dependencies, so stable pins released versions.
- publish creates the tag and the GitHub release last, on the released
  commit, with a token from the release GitHub App, the only actor the
  release-tags-create ruleset lets create a v* tag.
- crates, docker and publish run in the release environment, which a
  bbot-leads member approves. crates.io uses trusted publishing and
  skips a version already published. docker drops the dev tag; dev
  images go to GHCR.
- The tag subcommand and release.sh, which cut tags by hand, are gone.

Author: singlerider

.github/workflows/crates.yml

@@ -9,11 +9,9 @@ on:
         description: Repository script run before cargo publish. It may append to $GITHUB_ENV.
         type: string
         default: ""
-      environment:
+      version:
+        description: version output of release-check.yml
         type: string
-        default: release
-    secrets:
-      CARGO_REGISTRY_TOKEN:
         required: true
 
 permissions:
@@ -22,7 +20,10 @@ permissions:
 jobs:
   crates:
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.environment }}
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
@@ -31,10 +32,23 @@ jobs:
         with:
           persist-credentials: false
       - run: rustup show active-toolchain || rustup toolchain install
-      - if: inputs.setup-script != ''
+      - id: published
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          crate=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].name')
+          if curl -sf -o /dev/null -H "User-Agent: $GITHUB_REPOSITORY" "https://crates.io/api/v1/crates/$crate/$VERSION"; then
+            echo "::notice::$crate $VERSION is already on crates.io"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.published.outputs.skip != 'true' && inputs.setup-script != ''
         env:
           SCRIPT: ${{ inputs.setup-script }}
         run: '"./$SCRIPT"'
-      - env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - if: steps.published.outputs.skip != 'true'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - if: steps.published.outputs.skip != 'true'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked

.github/workflows/docker.yml

@@ -10,9 +10,6 @@ on:
         description: version output of release-check.yml
         type: string
         required: true
-      prerelease:
-        type: string
-        required: true
       major:
         type: string
         required: true
@@ -57,11 +54,10 @@ jobs:
   build:
     needs: plan
     runs-on: ubuntu-24.04
+    environment: release
     strategy:
       matrix:
         build: ${{ fromJSON(needs.plan.outputs.builds) }}
-    env:
-      RELEASE: ${{ inputs.prerelease == 'false' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -80,11 +76,10 @@ jobs:
             suffix=${{ matrix.build.suffix }}
           tags: |
             type=raw,value=${{ inputs.version }}
-            type=raw,value=dev,enable=${{ env.RELEASE == 'false' }}
-            type=raw,value=latest,enable=${{ env.RELEASE }}
-            type=raw,value=stable,enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }}.${{ inputs.minor }},enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }},enable=${{ env.RELEASE }}
+            type=raw,value=latest
+            type=raw,value=stable
+            type=raw,value=${{ inputs.major }}.${{ inputs.minor }}
+            type=raw,value=${{ inputs.major }}
       - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
@@ -99,6 +94,7 @@ jobs:
     if: inputs.description
     needs: build
     runs-on: ubuntu-24.04
+    environment: release
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/publish.yml

@@ -2,12 +2,16 @@ name: Publish release
 on:
   workflow_call:
     inputs:
+      release-app-id:
+        description: App ID of the release GitHub App
+        type: string
+        required: true
       version:
         description: version output of release-check.yml, which the caller runs first
         type: string
         required: true
-      prerelease:
-        description: prerelease output of release-check.yml
+      tag:
+        description: tag output of release-check.yml. Created here, on the commit being released, after every artifact is published.
         type: string
         required: true
       images:
@@ -38,16 +42,26 @@ on:
       registry-token:
         description: Token for pulling private images; omit for public images
         required: false
+      release-app-key:
+        description: Private key of the release GitHub App, the only actor the tag rulesets let create a v* tag
+        required: true
 
 permissions:
   contents: read
 
 jobs:
   release:
     runs-on: ubuntu-24.04
+    environment: release
     permissions:
-      contents: write
+      contents: read
     steps:
+      - id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ inputs.release-app-id }}
+          private-key: ${{ secrets.release-app-key }}
+          permission-contents: write
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -67,26 +81,24 @@ jobs:
         with:
           path: .
           format: spdx-json
-          output-file: sbom/${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
+          output-file: sbom/${{ github.event.repository.name }}-${{ inputs.tag }}.spdx.json
           upload-artifact: false
           upload-release-assets: false
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          TAG: ${{ inputs.tag }}
           VERSION: ${{ inputs.version }}
-          PRERELEASE: ${{ inputs.prerelease }}
           CHANGELOG: ${{ inputs.changelog }}
           ASSETS: ${{ inputs.assets }}
         run: |
-          flags=(--verify-tag)
+          flags=(--target "$GITHUB_SHA")
           if [ -n "$CHANGELOG" ]; then
             uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py notes "$CHANGELOG" "$VERSION" > "$RUNNER_TEMP/notes.md"
             flags+=(--notes-file "$RUNNER_TEMP/notes.md")
           else
             flags+=(--generate-notes)
           fi
-          [ "$PRERELEASE" = true ] && flags+=(--prerelease)
           gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || gh release create "$TAG" -R "$GITHUB_REPOSITORY" "${flags[@]}"
           shopt -s globstar nullglob
           files=(sbom/*.spdx.json)
@@ -97,16 +109,24 @@ jobs:
     if: inputs.images != '[]'
     needs: release
     runs-on: ubuntu-24.04
+    environment: release
     permissions:
-      contents: write
+      contents: read
     strategy:
       matrix:
         image: ${{ fromJSON(inputs.images) }}
     steps:
       - id: name
         env:
           IMAGE: ${{ matrix.image }}
-        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${GITHUB_REF_NAME}.spdx.json" >> "$GITHUB_OUTPUT"
+          TAG: ${{ inputs.tag }}
+        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${TAG}.spdx.json" >> "$GITHUB_OUTPUT"
+      - id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ inputs.release-app-id }}
+          private-key: ${{ secrets.release-app-key }}
+          permission-contents: write
       - id: auth
         env:
           TOKEN: ${{ secrets.registry-token }}
@@ -125,7 +145,7 @@ jobs:
           upload-artifact: false
           upload-release-assets: false
       - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          TAG: ${{ inputs.tag }}
           FILE: ${{ steps.name.outputs.file }}
         run: gh release upload "$TAG" -R "$GITHUB_REPOSITORY" --clobber "$FILE"

.github/workflows/release-check.yml

@@ -11,18 +11,18 @@ on:
         default: ""
     outputs:
       version:
-        description: Manifest version, equal to the tag. Every tracked Helm Chart.yaml version and appVersion must equal it too.
+        description: Manifest version of the merged commit. Every tracked Helm Chart.yaml version and appVersion must equal it.
         value: ${{ jobs.check.outputs.version }}
-      prerelease:
-        description: true for vX.Y.Z-rc.N tags
-        value: ${{ jobs.check.outputs.prerelease }}
-      semver:
-        description: The tag without its v prefix
-        value: ${{ jobs.check.outputs.semver }}
+      tag:
+        description: v<version>, created by publish.yml once everything is published
+        value: ${{ jobs.check.outputs.tag }}
       major:
         value: ${{ jobs.check.outputs.major }}
       minor:
         value: ${{ jobs.check.outputs.minor }}
+      release:
+        description: false when the version already has a GitHub release, so a push that keeps the version publishes nothing
+        value: ${{ jobs.check.outputs.release }}
 
 permissions:
   contents: read
@@ -31,15 +31,17 @@ jobs:
   check:
     runs-on: ubuntu-24.04
     outputs:
-      version: ${{ steps.tag.outputs.version }}
-      prerelease: ${{ steps.tag.outputs.prerelease }}
-      semver: ${{ steps.tag.outputs.semver }}
-      major: ${{ steps.tag.outputs.major }}
-      minor: ${{ steps.tag.outputs.minor }}
+      version: ${{ steps.manifest.outputs.version }}
+      tag: ${{ steps.manifest.outputs.tag }}
+      major: ${{ steps.manifest.outputs.major }}
+      minor: ${{ steps.manifest.outputs.minor }}
+      release: ${{ steps.new.outputs.release }}
     steps:
-      - if: github.ref_type != 'tag'
+      - if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch)
+        env:
+          TRUNK: ${{ github.event.repository.default_branch }}
         run: |
-          echo "::error::releases run on tag pushes only"
+          echo "::error::releases run from $TRUNK only"
           exit 1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -51,15 +53,25 @@ jobs:
           path: .shared
           persist-credentials: false
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-      - id: tag
+      - id: manifest
         env:
           ROOT: ${{ inputs.working-directory }}
-          TAG: ${{ github.ref_name }}
-        run: uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py --root "$ROOT" tag "$TAG"
+        run: uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py --root "$ROOT" release
       - if: inputs.check-script != ''
         env:
           SCRIPT: ${{ inputs.check-script }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ steps.manifest.outputs.tag }}
         run: |
           read -ra cmd <<<"$SCRIPT"
           "./${cmd[0]}" "${cmd[@]:1}" "$TAG"
+      - id: new
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.manifest.outputs.tag }}
+        run: |
+          if gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "::notice::$TAG is already released, nothing to publish"
+            echo "release=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "release=true" >> "$GITHUB_OUTPUT"
+          fi

scripts/manifest.py

@@ -10,11 +10,9 @@
 from enum import Enum
 from pathlib import Path
 
-import yaml
 from packaging.specifiers import SpecifierSet
 from packaging.version import Version
 
-TAG = re.compile(r"^v(?P<version>\d+\.\d+\.\d+(?:-rc\.(?P<rc>\d+))?)$")
 MANIFESTS = ("pyproject.toml", "Cargo.toml", "package.json")
 
 
@@ -140,25 +138,35 @@ def cmd_matrix(args):
     )
 
 
-def cmd_tag(args):
-    match = TAG.match(args.tag)
-    if not match:
-        sys.exit(f"tag {args.tag} is not vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-rc.N")
+def git_dependencies(root):
+    pyproject = load(root / "pyproject.toml")
+    project = pyproject.get("project", {})
+    found = [d for d in project.get("dependencies", []) if "git+" in d]
+    for group in project.get("optional-dependencies", {}).values():
+        found += [d for d in group if "git+" in d]
+    tool = pyproject.get("tool", {})
+    found += [name for name, source in tool.get("uv", {}).get("sources", {}).items() if "git" in source]
+    for table in ("dependencies", "dev-dependencies"):
+        found += [name for name, spec in tool.get("poetry", {}).get(table, {}).items() if isinstance(spec, dict) and "git" in spec]
+    cargo = load(root / tool.get("maturin", {}).get("manifest-path", "Cargo.toml"))
+    for table in ("dependencies", "build-dependencies"):
+        found += [name for name, spec in cargo.get(table, {}).items() if isinstance(spec, dict) and "git" in spec]
+    return found
+
+
+def cmd_release(args):
     declared = version(args.root)
-    if Version(declared) != Version(match["version"]):
-        sys.exit(f"tag {args.tag} does not match manifest version {declared}")
+    parsed = Version(declared)
+    if parsed.is_prerelease or parsed.is_devrelease or str(parsed) != declared:
+        sys.exit(f"{declared} is not a MAJOR.MINOR.PATCH release version")
     for chart in charts(args.root):
         for field, value in chart_fields(chart).items():
-            if value != match["version"]:
-                sys.exit(f"tag {args.tag} does not match {chart} {field} {value}")
-    major, minor, _ = match["version"].split("-")[0].split(".")
-    emit(
-        version=declared,
-        semver=match["version"],
-        major=major,
-        minor=minor,
-        prerelease=str(match["rc"] is not None).lower(),
-    )
+            if value != declared:
+                sys.exit(f"{chart} {field} {value} does not match manifest version {declared}")
+    pinned = git_dependencies(args.root)
+    if pinned:
+        sys.exit(f"stable must pin released versions, not git sources: {', '.join(pinned)}")
+    emit(version=declared, tag=f"v{declared}", major=str(parsed.major), minor=str(parsed.minor))
 
 
 def cmd_notes(args):
@@ -177,16 +185,6 @@ def cmd_notes(args):
     print("\n".join(section).strip())
 
 
-def cmd_caller(args):
-    for path in sorted((args.root / ".github" / "workflows").glob("*.y*ml")):
-        for job in (yaml.safe_load(path.read_text()) or {}).get("jobs", {}).values():
-            if "/.github/workflows/release-check.yml@" in str(job.get("uses", "")):
-                given = job.get("with", {})
-                print(json.dumps({"working-directory": given.get("working-directory", "."), "check-script": given.get("check-script", "")}))
-                return
-    sys.exit(f"no job in {args.root}/.github/workflows calls release-check.yml")
-
-
 def cmd_images(args):
     listed = subprocess.run(["git", "ls-files", "-z", "--", "Dockerfile*"], cwd=args.root, capture_output=True, text=True, check=True)
     builds = []
@@ -204,14 +202,11 @@ def main():
     parser.add_argument("--root", type=Path, default=Path("."))
     sub = parser.add_subparsers(required=True)
     sub.add_parser("matrix").set_defaults(func=cmd_matrix)
-    tag = sub.add_parser("tag")
-    tag.add_argument("tag")
-    tag.set_defaults(func=cmd_tag)
+    sub.add_parser("release").set_defaults(func=cmd_release)
     notes = sub.add_parser("notes")
     notes.add_argument("changelog", type=Path)
     notes.add_argument("version")
     notes.set_defaults(func=cmd_notes)
-    sub.add_parser("caller").set_defaults(func=cmd_caller)
     images = sub.add_parser("images")
     images.add_argument("image")
     images.add_argument("version")