Skip to content

feat(release): develop to main - #429

Merged
bedatty merged 17 commits into
mainfrom
develop
Jun 17, 2026
Merged

feat(release): develop to main#429
bedatty merged 17 commits into
mainfrom
develop

Conversation

@bedatty

@bedatty bedatty commented Jun 17, 2026

Copy link
Copy Markdown
Contributor
Lerian

GitHub Actions Shared Workflows


Description

Type of Change

  • feat: New workflow or new input/output/step in an existing workflow
  • fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
  • perf: Performance improvement (e.g. caching, parallelism, reduced steps)
  • refactor: Internal restructuring with no behavior change
  • docs: Documentation only (README, docs/, inline comments)
  • ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
  • chore: Dependency bumps, config updates, maintenance
  • test: Adding or updating tests
  • BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

  • YAML syntax validated locally
  • Triggered a real workflow run on a caller repository using @this-branch or the beta tag
  • Verified all existing inputs still work with default values
  • Confirmed no secrets or tokens are printed in logs
  • Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

Summary by CodeRabbit

  • New Features

    • Added configurable backmerge controls in release workflow (enable/disable, branch selection, merge strategy, dry-run mode)
    • Added Go linting argument configuration to validation workflow
  • Changes

    • GitHub Container Registry publishing now enabled by default
    • Code coverage threshold enforcement enabled by default in Go workflows
    • Updated security scanning tool versions (gosec, TruffleHog)
    • Refactored release workflow logic for improved backmerge handling
  • Documentation

    • Updated workflow input documentation to reflect new defaults and configurations

lerian-studio and others added 17 commits June 10, 2026 13:16
Bumps the notifications group with 1 update in the / directory: [rtCamp/action-slack-notify](https://github.com/rtcamp/action-slack-notify).


Updates `rtCamp/action-slack-notify` from 2.3.3 to 2.4.0
- [Release notes](https://github.com/rtcamp/action-slack-notify/releases)
- [Commits](rtCamp/action-slack-notify@e31e87e...33ca3be)

---
updated-dependencies:
- dependency-name: rtCamp/action-slack-notify
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: notifications
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps the docker group with 1 update in the / directory: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action).


Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@ce36039...0611638)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps the utilities group with 1 update: [mikefarah/yq](https://github.com/mikefarah/yq).


Updates `mikefarah/yq` from 4.53.2 to 4.53.3
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@751d8ad...1b9b4ac)

---
updated-dependencies:
- dependency-name: mikefarah/yq
  dependency-version: 4.53.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: utilities
...

Signed-off-by: dependabot[bot] <support@github.com>
…mantic-release plugin

Move backmerge out of the @saithodev/semantic-release-backmerge plugin and
into a dedicated backmerge-sync step that runs after a successful release.
This removes the continue-on-error + release-tag-snapshot + release-tag-check
+ backmerge-pr fallback machinery that only existed to work around the plugin
masking the release outcome. Backmerge is now configurable via inputs and only
runs when the release ref matches backmerge_source (so beta releases on develop
are unaffected).
- Add dry_run input wired to both semantic-release (no tags/releases) and the
  backmerge-sync step (preview only), so callers can validate safely.
- Validate backmerge_mode and source/target branches before the release runs,
  failing fast instead of producing 'release published + job failed'.
- Document all three backmerge modes.
Align go-release.yml and build.yml with the TypeScript side (typescript-build.yml
already defaults to true). GHCR push is now on by default; callers must provide
MANAGE_TOKEN (org secret) or set enable_ghcr: false to opt out.
…e-lint-args-app-prefix

feat(release): orchestrate backmerge via backmerge-sync; expose go-pr-validation inputs & enforce coverage
… 2 updates

Bumps the security-scanners group with 2 updates in the / directory: [securego/gosec](https://github.com/securego/gosec) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).

Updates `securego/gosec` from 2.26.1 to 2.27.1
- [Release notes](https://github.com/securego/gosec/releases)
- [Commits](securego/gosec@4a3bd8a...9e6a984)

Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.5
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: securego/gosec
  dependency-version: 2.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-scanners
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-scanners
...

Signed-off-by: dependabot[bot] <support@github.com>

[skip ci]
…evelop/notifications-62941f1938

chore(deps): bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 in the notifications group across 1 directory
…evelop/utilities-6cde74802b

chore(deps): bump mikefarah/yq from 4.53.2 to 4.53.3 in the utilities group
@bedatty
bedatty requested a review from a team as a code owner June 17, 2026 20:48
@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

Multiple reusable workflows flip defaults for enable_ghcr and fail_on_coverage_threshold from false to true. go-pr-validation.yml gains golangci_lint_args and app_name_prefix inputs wired through to go-pr-analysis.yml, which fixes shell array expansion for lint args. release.yml replaces the semantic-release backmerge plugin with explicit backmerge_* workflow inputs and a direct backmerge step. Several pinned action SHAs are updated. Docs are updated to match.

Changes

Workflow input defaults, backmerge refactor, new lint inputs, and action SHA bumps

Layer / File(s) Summary
Default flips: enable_ghcrtrue, fail_on_coverage_thresholdtrue
.github/workflows/build.yml, .github/workflows/go-release.yml, .github/workflows/go-pr-validation.yml, .github/workflows/go-pr-analysis.yml, docs/build-workflow.md, docs/go-release-workflow.md, docs/go-pr-analysis-workflow.md
Breaking change for existing callers. enable_ghcr now defaults to true in build.yml and go-release.yml. fail_on_coverage_threshold now defaults to true in go-pr-validation.yml and go-pr-analysis.yml. Callers not explicitly setting these will change behavior. Docs updated to match.
New golangci_lint_args and app_name_prefix inputs wired through validation chain
.github/workflows/go-pr-validation.yml, .github/workflows/go-pr-analysis.yml, docs/go-pr-validation.md
go-pr-validation.yml adds golangci_lint_args (default --timeout=5m) and app_name_prefix (default '') and passes both to go-pr-analysis.yml. The analysis workflow's direct lint path switches from string interpolation to shell array expansion for golangci_lint_args.
release.yml backmerge redesign: new inputs, preflight validation, direct step
.github/workflows/release.yml, docs/release-workflow.md
Adds five workflow_call inputs (backmerge_enabled, backmerge_source, backmerge_target, backmerge_mode, dry_run). Removes the @saithodev/semantic-release-backmerge plugin dependency. Replaces snapshot-tag/detect-and-fallback logic with a preflight validator and a direct backmerge-sync step gated on semantic-release publishing success. Publish-marker script simplified to use only semantic-release output. Migration note added to docs.
Pinned action SHA updates
.github/workflows/build.yml, .github/workflows/go-pr-analysis.yml, .github/workflows/go-security.yml, .github/workflows/helm-update-chart.yml, .github/workflows/slack-notify.yml
securego/gosec bumped to v2.27.1 in two workflows. trufflesecurity/trufflehog bumped to v3.95.5. mikefarah/yq@v4, docker/setup-qemu-action@v4, and rtCamp/action-slack-notify@v2 re-pinned to new commit SHAs.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

Possibly related PRs

Suggested labels

workflow, documentation, golang, github-config, validate

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description is entirely empty—only the template structure with unchecked boxes and placeholder comments is present, providing zero substantive information about what changed or why. Complete the Description section with summary of affected workflows and behavior changes, check the 'feat' box, and provide a caller repo/workflow run link in the Testing section.
Title check ❓ Inconclusive The title 'feat(release): develop to main' is vague and generic, describing a merge direction rather than the substantive changes (workflow inputs, defaults, backmerge refactor, dependency updates). Revise title to reflect primary changes: e.g., 'feat(workflows): enable GHCR/coverage by default, refactor release backmerge' or similar to clarify the actual modifications.
✅ Passed checks (3 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch develop

Comment @coderabbitai help to get the list of available commands and usage tips.

@lerian-studio lerian-studio added size/S PR changes 50–199 lines documentation Improvements or additions to documentation workflow Changes to one or more reusable workflow files security Changes to security workflows or vulnerability reporting policy golang Changes to Go-related workflows github-config Changes to repository configuration (templates, CODEOWNERS, labeler, etc.) notify Changes to notification composite actions (src/notify/) validate Changes to PR validation composite actions (src/validate/) labels Jun 17, 2026
@lerian-studio

lerian-studio commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check Status Blocking
Source Branch ✅ success yes
PR Title ✅ success yes
PR Description ✅ success yes
PR Size ✅ success no
Auto Labels ✅ success no
PR Metadata ✅ success no

🔍 View workflow run

@lerian-studio

lerian-studio commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.


🔍 View full scan logs | 🛡️ Security tab

@lerian-studio

lerian-studio commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

🔍 Lint Analysis

Check Files Scanned Status
YAML Lint 9 file(s) ✅ success
Action Lint 8 file(s) ✅ success
Pinned Actions 8 file(s) ✅ success
Markdown Link Check 5 file(s) ✅ success
Spelling Check 14 file(s) ✅ success
Shell Check 8 file(s) ✅ success
README Check 8 file(s) ✅ success
Composite Schema no changes ⏭️ skipped
Deployment Matrix no changes ⏭️ skipped

🔍 View full scan logs

@bedatty
bedatty merged commit 09bb47a into main Jun 17, 2026
46 of 51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation github-config Changes to repository configuration (templates, CODEOWNERS, labeler, etc.) golang Changes to Go-related workflows notify Changes to notification composite actions (src/notify/) security Changes to security workflows or vulnerability reporting policy size/S PR changes 50–199 lines validate Changes to PR validation composite actions (src/validate/) workflow Changes to one or more reusable workflow files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants