-
Notifications
You must be signed in to change notification settings - Fork 23
feat: release automation configs #312
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,36 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| name: release-please | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| branches: [main] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| inputs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| bump-type: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description: > | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Version bump type. Select 'explicit' to supply an exact version via | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| the 'release-version' field below. Select 'auto' to let | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| conventional-commits determine the bump automatically. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| required: false | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| type: choice | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| default: 'auto' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| options: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - auto | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - patch | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - minor | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - major | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - explicit | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| release-version: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description: > | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Explicit version to release (e.g. 1.2.3 or 1.4.0-beta.1). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| required: false | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| type: string | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| release: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| uses: openfga/sdk-generator/.github/workflows/release-please.yml@main | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| bump-type: ${{ inputs.bump-type || 'auto' }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| release-version: ${{ inputs.release-version || '' }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+32
to
+33
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| bump-type: ${{ inputs.bump-type || 'auto' }} | |
| release-version: ${{ inputs.release-version || '' }} | |
| bump-type: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.bump-type || 'auto') || 'auto' }} | |
| release-version: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.release-version || '') || '' }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, to fix this issue you should explicitly declare a permissions block in the workflow (either at the root or per-job) that grants only the minimal scopes required for the job. This prevents the workflow from inheriting broader default GITHUB_TOKEN permissions from the repository or organization.
For this specific file, the safest and most compatible approach—without changing existing functionality—is to add a root-level permissions block that grants read-only access to repository contents, which is a common minimal baseline and aligns with the suggested “minimal starting point” in the warning. Because this workflow simply delegates to a reusable workflow via uses: openfga/sdk-generator/.github/workflows/release-please.yml@main and we cannot see its internals, we should not try to guess additional write scopes; if that reusable workflow needs more, it can (and should) request them itself. The change should be added near the top of .github/workflows/release-please.yml, for example immediately after the name: release-please line, so that it applies to all jobs defined in this workflow (including the release job).
No additional imports or methods are needed; only YAML configuration changes are required.
-
Copy modified lines R3-R5 -
Copy modified line R36
| @@ -1,5 +1,8 @@ | ||
| name: release-please | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| @@ -30,7 +33,7 @@ | ||
| uses: openfga/sdk-generator/.github/workflows/release-please.yml@main | ||
| with: | ||
| bump-type: ${{ inputs.bump-type || 'auto' }} | ||
| release-version: ${{ inputs.release-version || '' }} | ||
| release-version: ${{ inputs-release-version || '' }} | ||
| secrets: | ||
| APP_ID: ${{ secrets.APP_ID }} | ||
| APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| { | ||
| ".": "0.9.7" | ||
| } |
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,103 @@ | ||||||||
| # Release guide | ||||||||
|
|
||||||||
| This project uses [release-please](https://github.com/googleapis/release-please) via a | ||||||||
| `workflow_dispatch`-triggered GitHub Actions workflow. This document explains how to cut | ||||||||
| a release and what to watch out for. | ||||||||
|
Comment on lines
+3
to
+5
|
||||||||
|
|
||||||||
| --- | ||||||||
|
|
||||||||
| ## Versioning rules for this project | ||||||||
|
|
||||||||
| We are pre-1.0.0. Semver conventions are relaxed: | ||||||||
|
|
||||||||
| | Change type | Bump | Example | | ||||||||
| |--- |--- |--- | | ||||||||
| | Breaking change | **Minor** (`0.x.0`) | `0.9.0` → `0.10.0` | | ||||||||
| | Everything else | **Patch** (`0.0.x`) | `0.9.7` → `0.9.8` | | ||||||||
|
|
||||||||
| Major bumps (`1.0.0`) are reserved for a deliberate stable-API graduation decision — not for | ||||||||
| routine breaking changes. | ||||||||
|
|
||||||||
| --- | ||||||||
|
|
||||||||
| ## Cutting a release | ||||||||
|
|
||||||||
| 1. Go to **Actions → release-please** and click **Run workflow**. | ||||||||
| 2. Choose a bump type: | ||||||||
| - `patch` — bugfixes, docs, small changes | ||||||||
| - `minor` — breaking changes (see above) | ||||||||
| - `explicit` — you specify the exact version string (e.g. `0.10.0` or `0.10.0-beta.1`) | ||||||||
| 3. The workflow creates a release PR. Review it, then merge. | ||||||||
| 4. The GitHub Release and tag are created automatically on merge. | ||||||||
|
|
||||||||
|
Comment on lines
+31
to
+32
|
||||||||
| 4. The GitHub Release and tag are created automatically on merge. | |
| 4. On merge, `.github/workflows/main.yaml` automatically creates a **draft** GitHub Release and tag. This workflow is the single source of truth for creating GitHub Releases and tags; do not enable release creation in the release-please workflow to avoid duplicates. | |
| 5. When you are ready to publish, go to **Releases**, review the draft release created by `.github/workflows/main.yaml`, and click **Publish release**. |
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,28 @@ | ||||||||||
| { | ||||||||||
| "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", | ||||||||||
| "release-type": "simple", | ||||||||||
| "packages": { | ||||||||||
| ".": { | ||||||||||
| "include-component-in-tag": false, | ||||||||||
| "changelog-path": "CHANGELOG.md", | ||||||||||
| "changelog-type": "default", | ||||||||||
| "bump-minor-pre-major": true, | ||||||||||
| "bump-patch-for-minor-pre-major": true, | ||||||||||
| "changelog-sections": [ | ||||||||||
| { "type": "feat", "section": "Added", "hidden": false }, | ||||||||||
| { "type": "fix", "section": "Fixed", "hidden": false }, | ||||||||||
| { "type": "perf", "section": "Changed", "hidden": false }, | ||||||||||
| { "type": "refactor", "section": "Changed", "hidden": false }, | ||||||||||
| { "type": "revert", "section": "Removed", "hidden": false }, | ||||||||||
| { "type": "docs", "section": "Documentation", "hidden": false }, | ||||||||||
| { "type": "test", "section": "Tests", "hidden": true }, | ||||||||||
| { "type": "ci", "section": "CI", "hidden": true }, | ||||||||||
| { "type": "chore", "section": "Miscellaneous", "hidden": true } | ||||||||||
| ], | ||||||||||
| "extra-files": [ | ||||||||||
| { "type": "generic", "path": "build.gradle" }, | ||||||||||
| { "type": "generic", "path": "src/main/java/dev/openfga/sdk/constants/FgaConstants.java" } | ||||||||||
|
||||||||||
| { "type": "generic", "path": "src/main/java/dev/openfga/sdk/constants/FgaConstants.java" } | |
| { "type": "generic", "path": "src/main/java/dev/openfga/sdk/constants/FgaConstants.java" }, | |
| { "type": "generic", "path": "publish.gradle" }, | |
| { "type": "generic", "path": "README.md" } |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -19,7 +19,7 @@ | |||||
| public final class FgaConstants { | ||||||
|
|
||||||
| /** Version of the OpenFGA Java SDK. */ | ||||||
| public static final String SDK_VERSION = "0.9.7"; | ||||||
| public static final String SDK_VERSION = "0.9.7"; // x-release-please-version | ||||||
|
||||||
| public static final String SDK_VERSION = "0.9.7"; // x-release-please-version | |
| public static final String SDK_VERSION = "0.9.7"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The reusable workflow is referenced with
@main. To reduce supply-chain risk and ensure reproducible releases, pin this to a specific commit SHA or a version tag ofopenfga/sdk-generatorinstead of a moving branch.