fix: add contents write permission and force tag updates #320
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR fixes GitHub workflow permissions and improves the tag update process by adding necessary write permissions and using force operations instead of delete-and-recreate operations for Git tags.
- Adds
contents: writepermission to enable the workflow to write to the repository - Simplifies tag update operations by using force flags instead of explicit delete operations
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
WalkthroughRelease workflow simplified: added top-level Changes
Sequence Diagram(s)sequenceDiagram
participant Runner as GitHub Actions Runner
participant Local as local Git repo
participant Remote as origin (remote)
Note over Runner: Determine tag to update
Runner->>Local: git tag --list --sort=-v:refname
Runner->>Local: head -n1 | cut -d. -f1 => MAJOR_VERSION
alt inputs.tag provided
Runner->>Local: tag = inputs.tag
else
Runner->>Local: tag = MAJOR_VERSION
end
Note over Runner,Local: Force-annotate/tag locally
Runner->>Local: git tag --force --annotate <tag> -m "Retag <tag>"
Note over Runner,Remote: Force-push tag to origin
Runner->>Remote: git push origin <tag> --force
Note over Remote: rolling tag updated
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
34-42: Tighten conditions to avoid ambiguity across events.Guard steps by event type to prevent empty/undefined inputs from surprising behavior on release vs. manual runs.
Apply:
- - name: Update tag with parameter - if: github.event.inputs.tag != '' + - name: Update tag with parameter + if: ${{ github.event_name == 'workflow_dispatch' && inputs.tag != '' }} - - name: Update rolling tag - if: github.event.inputs.tag == '' + - name: Update rolling tag + if: ${{ github.event_name == 'release' && github.event.action == 'released' }}Rationale: make the intent explicit—manual dispatch uses the provided tag; release events advance the rolling
v2tag. If you still want dispatch-with-empty-tag to fall back tov2, keep the second condition OR add a third step for that case.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/release.yml(2 hunks)
🔇 Additional comments (3)
.github/workflows/release.yml (3)
36-38: LGTM: safer, simpler forced retag.Replacing delete/recreate with
git tag -fa+git push --forceis correct and avoids transient missing-tag windows.
41-42: LGTM: rolling tag update is consistent with the parameterized step.The forced update for the rolling
v2tag matches the new approach and should behave deterministically.
18-20: Grant the GitHub App “workflows” permission in Settings (cannot be set in the workflow file)The
permissions: contents: writeline only elevates the GITHUB_TOKEN’s access to repository contents (e.g. pushing tags) and does not grant any rights to create or modify workflow YAML files. GitHub Apps must have their Workflows permission granted at the App-level or repository settings (or you must use a PAT scoped toworkflow) to avoid the error:refusing to allow a GitHub App to create or update workflow
.github/workflows/...withoutworkflowspermissionKey points:
- The
permissions:block in a workflow supports only the built-in token scopes (contents, checks, issues, deployments, etc.) and does not include aworkflowskey.- To resolve the error, navigate to your repository’s Settings → Actions → General → Workflow permissions, and grant the GitHub Actions App “Read and write permissions” for Workflows.
- Alternatively, replace GITHUB_TOKEN with a PAT that has the
workflowscope.Let me know if you’d like a short maintainer note or sample instructions on how to configure that setting.
There was a problem hiding this comment.
This seems fine. Although it is just a temp patch.
- I personally prefer using the long arg name for passersby. But I already know that
-fameans--force --annotateand-mis a pretty commonly used. - The 2 steps could be consolidated using
${{ inputs.tag || 'v2' }}. But that does not account for if/when the major version is bumped v3. It might be better to extract the major version from the most recent fully-qualified version (not vX but vX.Y.Z)...
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
33-39: Fix rolling-tag step to use shell fallback, fetch tags, and tag the release commit
- Fetch tags and enable strict shell mode (
set -euo pipefail) to ensure tags are available and fail-fast (actions/checkout defaults to depth = 1 andfetch-tags: false) (github.com).- Perform the fallback in shell (
TAG_INPUT="${{ inputs.tag }}"andTAG="${TAG_INPUT:-$MAJOR_VERSION}") instead of mixing Actions expressions with shell variables ($MAJOR_VERSIONwon’t expand inside${{ }}) (docs.github.com).- Use
GITHUB_SHA(last commit in the tagged release) as the target SHA when retagging (GITHUB_SHAis set to the commit of the release event) (docs.github.com).Apply this diff in the
runblock:- # Get the major version from the latest tag - MAJOR_VERSION=`git tag --list --sort=-v:refname | head -n1 | cut -d. -f1` - git tag --force --annotate ${{ inputs.tag || '$MAJOR_VERSION' }} --message 'Retag ${{ inputs.tag || '$MAJOR_VERSION' }}' - git push origin ${{ inputs.tag || '$MAJOR_VERSION' }} --force + set -euo pipefail + # Ensure tags are available + git fetch --tags --force + # Determine latest major (expects tags like v2.3.4; falls back to whole tag if no dot) + LATEST_TAG="$(git tag --list 'v[0-9]*' --sort=-v:refname | head -n1 || true)" + MAJOR_VERSION="${LATEST_TAG%%.*}" + TAG_INPUT="${{ inputs.tag }}" + TAG="${TAG_INPUT:-$MAJOR_VERSION}" + if [ -z "${TAG}" ]; then + echo "No tags found and no tag input provided"; exit 1 + fi + # Point rolling tag at the released commit when available, else current HEAD + TARGET_SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}" + git tag --force --annotate "${TAG}" "${TARGET_SHA}" --message "Retag ${TAG}" + git push origin "refs/tags/${TAG}" --forceOptionally set
fetch-depth: 0andfetch-tags: trueonactions/checkout(github.com).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/release.yml(2 hunks)
closes #318
Summary by CodeRabbit