fix(ci)!: convert auto-bump to PR-native flow with signed commits#110
Merged
Conversation
📦 Release PreviewThis analysis shows the expected release impact: 📈 Expected Version Changes📋 Package Details[
{
"package_name": "keycardai-a2a",
"package_dir": "packages/a2a",
"has_changes": true,
"current_version": "0.2.0",
"next_version": "0.3.0",
"increment": "MINOR"
},
{
"package_name": "keycardai-starlette",
"package_dir": "packages/starlette",
"has_changes": true,
"current_version": "0.3.0",
"next_version": "0.4.0",
"increment": "MINOR"
}
]📝 Changelog PreviewThis comment was automatically generated by the release preview workflow. |
Branch protection on main blocks the previous direct-push bump (commits must come through PRs and have verified signatures). Rewrites the bump script and workflow to satisfy both rules without a permanent ruleset bypass. New flow per package bump: 1. cz bump --files-only updates pyproject.toml + CHANGELOG.md locally, no commit, no tag. 2. A bump/<package>-<version> branch is created on the remote at the current main tip via REST refs API. 3. The bumped files commit onto that branch via the GraphQL createCommitOnBranch mutation, which signs the commit as the authenticated bot identity. 4. gh pr create + gh pr merge --auto --squash opens the PR and tells it to merge itself once required CI checks pass. 5. Script polls the PR state every 30s up to 30min. On MERGED, captures the squash-merge SHA on main. 6. Creates the <version>-<package> tag at that SHA via REST refs API. Tags trigger the existing release.yml publish workflow as before. Workflow grants pull-requests: write and surfaces RELEASE_GITHUB_PAT as GH_TOKEN so gh CLI calls authenticate as the PAT owner. The squash-merge means the cz commit author info ends up on the merge commit, not the bot identity. The signing comes from GitHub auto-signing the GraphQL-created commit before the squash; once merged, the squash commit inherits that verified signature.
Larry-Osakwe
force-pushed
the
larry/bump-script-pr-native
branch
from
a13320e to
8e98963
Compare
📦 Release PreviewThis analysis shows the expected release impact: 📈 Expected Version Changes📋 Package Details[
{
"package_name": "keycardai-a2a",
"package_dir": "packages/a2a",
"has_changes": true,
"current_version": "0.2.0",
"next_version": "0.3.0",
"increment": "MINOR"
},
{
"package_name": "keycardai-starlette",
"package_dir": "packages/starlette",
"has_changes": true,
"current_version": "0.3.0",
"next_version": "0.4.0",
"increment": "MINOR"
}
]📝 Changelog PreviewThis comment was automatically generated by the release preview workflow. |
jelmersnoeck
approved these changes
Apr 30, 2026
Larry-Osakwe
added a commit
that referenced
this pull request
Apr 30, 2026
…follow-up) (#111) PR #110 added pull-requests: write to bump-package.yml so the new auto-merge-PR flow can call gh pr create. The calling workflow main.yml only granted contents: write, so the called workflow could not request the new permission. GitHub fails workflow validation in that case rather than silently dropping the permission. Adds pull-requests: write to the bump-packages job in main.yml so the called bump-package.yml inherits both write scopes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Branch protection on
main(rolled out org-wide today) requires changes through PRs and verified signatures. The previous auto-bump script doesgit push origin main --follow-tagsdirectly, which fails both rules. This rewrites the flow so it routes through a PR and signs commits via GitHub's API.New flow
Per package bump:
cz bump --files-onlyupdatespyproject.toml(cz version field) andCHANGELOG.mdin the package directory. No local commit or tag.bump/<package>-<version>branch is created on the remote at the currentmaintip via REST refs API.createCommitOnBranchmutation, which signs the commit as the authenticated bot identity (the owner ofRELEASE_GITHUB_PAT).gh pr create+gh pr merge --auto --squashopens the PR and tells it to merge itself once required CI checks pass.MERGED, captures the squash-merge SHA onmain.<version>-<package>tag at that SHA via REST refs API. Tags trigger the existingrelease.ymlpublish workflow as before.Workflow change
bump-package.ymlnow grantspull-requests: writeand surfacesRELEASE_GITHUB_PATasGH_TOKENso theghCLI calls authenticate.What this lets the rules ruleset enforce again
maininherits a verified signature from GitHub's merge mechanism.Once this lands, Jelmer can drop any temporary allow-list put in place to unblock today.
Tradeoffs
Coordination
Don't merge this until Jelmer has restored protections on
main. The new flow needs the rules in place to be meaningful; without them, the old direct-push flow would still work and there'd be no forcing function. After merge, run any failed bump (e.g.keycardai-a2a0.3.0) to validate end-to-end.