feat(release): split release workflow into least-privilege variants - #180
Draft
jmeridth wants to merge 1 commit into
Draft
feat(release): split release workflow into least-privilege variants#180jmeridth wants to merge 1 commit into
jmeridth wants to merge 1 commit into
Conversation
Relates to #149 ## What/Why Callers of release.yaml were forced to grant all six permission scopes because GitHub validates nested job permissions at parse time, before if conditions. Adds least-privilege variants (minimal, goreleaser, goreleaser-attest, container, container-attest) composed from shared release-draft/release-publish building blocks, and revives release-discussion.yaml as a chainable workflow. release.yaml is unchanged for back-compat. ## Proof it works actionlint passes on all workflows. test-release.yaml now dogfoods release-container-attest.yaml plus the chained discussion workflow, so this repo's own release exercises the new path on merge. ## Risk + AI role medium -- touches this repo's own release path via test-release.yaml. Workflow logic extracted verbatim from release.yaml. AI-generated (Claude Fable 5), human-directed design decisions. ## Review focus - Publish gating conditions in each variant (skipped/failed build jobs must block publish; attest_sboms may legitimately skip) - test-release.yaml switch: next merge to main releases via the new variant instead of release.yaml Signed-off-by: jmeridth <jmeridth@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #149
What/Why
Callers of
release.yamlare forced to grant all six permission scopes because GitHub validates nested job permissions at parse time, beforeifconditions are evaluated. This adds least-privilege release variants composed from shared building blocks, so callers only grant what they actually use:release-minimal.yamlcontents: write,pull-requests: readrelease-goreleaser.yamlcontents: write,pull-requests: readrelease-goreleaser-attest.yamlid-token: write,attestations: writerelease-container.yamlpackages: writerelease-container-attest.yamlpackages: write,id-token: write,attestations: writerelease-discussion.yaml(revived, chainable)contents: read,discussions: writeEach variant unconditionally nests new
release-draft.yaml/release-publish.yamlbuilding blocks (single source of truth, also callable directly for custom compositions), preserving the draft -> build -> publish ordering that supports immutable releases.release.yamlis unchanged for backwards compatibility, andrelease-image.yamlstays a deprecated stub. Variants expose a newpublishedoutput so chained jobs (like the discussion announcement) only fire after a successful publish.Proof it works
test-release.yamlnow dogfoodsrelease-container-attest.yamlplus the chainedrelease-discussion.yaml, so this repository's own release exercises the new path (draft block, container build, attestation, publish block, discussion) on merge to main.Risk + AI role
medium -- switches this repository's own release path via
test-release.yaml. Build/publish logic was extracted verbatim fromrelease.yamlto minimize behavior drift. AI-generated with human-directed design decisions.Review focus
attest_sbomsmay legitimately skip (private repo or no SBOMs).test-release.yamlswitch: the next merge to main releases viarelease-container-attest.yamlinstead ofrelease.yaml.Readiness Checklist
Author/Contributor