Skip to content

ci: align release draft workflow with rokt-widget pattern #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nickolas-dimitrakas wants to merge 5 commits into
base: main
Choose a base branch
from
Open

ci: align release draft workflow with rokt-widget pattern #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
be2adda
ci: align release draft workflow with mparticle-apple-sdk pattern
nickolas-dimitrakas Apr 10, 2026
e45d1ee
ci: align release draft workflow with rokt-widget pattern
nickolas-dimitrakas Apr 10, 2026
47703cf
ci: remove bot token, add push trigger for release branches
nickolas-dimitrakas Apr 10, 2026
b59f14d
ci: simplify pull-request workflow triggers
nickolas-dimitrakas Apr 10, 2026
e6a52d5
ci: bump Xcode version to 26.2
nickolas-dimitrakas Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 29 additions & 28 deletions .github/workflows/draft-release-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
name: Create draft release
name: Release – Draft

on:
workflow_dispatch:
workflow_dispatch: # checkov:skip=CKV_GHA_7
inputs:
bump-type:
description: Specify if the version should be bumped as major, minor, patch
description: Specify if the version should be bumped as patch, minor, or major
required: true
type: choice
options:
- major
- minor
- patch
- minor
- major

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
Expand All @@ -21,14 +21,13 @@ permissions:
pull-requests: write

jobs:
publish-draft-release:
prepare-release:
runs-on: macos-latest

steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: main
fetch-depth: 0

- name: Get current version
id: version-file
Expand All @@ -38,33 +37,35 @@ jobs:

- name: Bump version
id: bump-version
uses: actions-ecosystem/action-bump-semver@v1
uses: actions-ecosystem/action-bump-semver@34e334551143a5301f38c830e44a22273c6ff5c5 # v1.0.0
with:
current_version: ${{ steps.version-file.outputs.release-version }}
level: ${{ github.event.inputs.bump-type }}

- name: Update podspec version
run: sed -i '' "s/s\.version[[:space:]]*=[[:space:]]*\"[0-9.]*\"/s.version = \"${{ steps.bump-version.outputs.new_version }}\"/" mParticle-Apple-Media-SDK.podspec
level: ${{ github.event.inputs.bump-type || 'patch' }}

- name: Update VERSION file
run: echo "${{ steps.bump-version.outputs.new_version }}" > VERSION

- name: Create Pull Request
uses: peter-evans/create-pull-request@v7
- name: Update podspec version
run: |
version="${{ steps.bump-version.outputs.new_version }}"
sed -i '' "s/s\.version[[:space:]]*=[[:space:]]*\"[0-9.]*\"/s.version = \"${version}\"/" mParticle-Apple-Media-SDK.podspec

- name: Generate changelog from git history
id: changelog
uses: ROKT/rokt-workflows/actions/generate-changelog@main
with:
version: ${{ steps.bump-version.outputs.new_version }}

- name: Create release PR
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
with:
commit-message: "Bump version to ${{ steps.bump-version.outputs.new_version }}"
commit-message: "Prepare release ${{ steps.bump-version.outputs.new_version }}"
branch: chore/release-${{ steps.bump-version.outputs.new_version }}
title: "chore: Release ${{ steps.bump-version.outputs.new_version }}"
base: main
base: ${{ github.ref_name }}
body: |
Preparing for release ${{ steps.bump-version.outputs.new_version }}

This PR updates the version from ${{ steps.version-file.outputs.release-version }} to ${{ steps.bump-version.outputs.new_version }} in:
- `mParticle-Apple-Media-SDK.podspec`
- `VERSION`

Bump type: **${{ github.event.inputs.bump-type }}**

**After merging**, this workflow will automatically:
- Create a git tag `${{ steps.bump-version.outputs.new_version }}`
- Publish to CocoaPods trunk
- Bumped version to ${{ steps.bump-version.outputs.new_version }}
- Updated changelog
## Changelog
${{ steps.changelog.outputs.release-notes }}
6 changes: 5 additions & 1 deletion .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,13 @@ name: CI

on:
pull_request:
push:
branches:
- main
- workstation/*
Copy link
Copy Markdown

@cursor cursor Bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing chore/release* push trigger defeats PR's stated purpose

High Severity

The push.branches trigger adds main and workstation/* but is missing chore/release*, which is the branch pattern that peter-evans/create-pull-request in draft-release-publish.yml creates (via branch: chore/release-${{ steps.bump-version.outputs.new_version }}). The PR description explicitly states the intent is to add chore/release* to bypass GitHub's restriction on GITHUB_TOKEN-created PRs not triggering pull_request events, but this pattern was omitted from the implementation. CI will still not fire on release PRs.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e6a52d5. Configure here.

Copy link
Copy Markdown

@cursor cursor Bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR-specific jobs lack guards for new push trigger

Medium Severity

The new push trigger causes pr-branch-check-name and pr-title-check jobs to run on push events (e.g., every merge to main), where no pull request context exists. These reusable workflows rely on PR data (github.event.pull_request) to check branch names and titles. Unlike pr-notify, which correctly guards with if: github.event_name == 'pull_request', these jobs have no such condition and will likely fail on every push-triggered run, creating persistent CI noise.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e6a52d5. Configure here.


env:
XCODE_VERSION: "16.4"
XCODE_VERSION: "26.2"

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
Expand Down
Loading