Skip to content

feat: add automated release workflow (tag-triggered)#943

Open
cloud-game-development-toolkit-bot wants to merge 1 commit into
mainfrom
feat/automated-release-workflow
Open

feat: add automated release workflow (tag-triggered)#943
cloud-game-development-toolkit-bot wants to merge 1 commit into
mainfrom
feat/automated-release-workflow

Conversation

@cloud-game-development-toolkit-bot

@cloud-game-development-toolkit-bot cloud-game-development-toolkit-bot commented May 29, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adds a release workflow triggered by pushing a semver tag. A maintainer releases by running:

git tag v1.2.0
git push origin v1.2.0

The workflow handles everything else: changelog generation, tag management, and publishing the GitHub release. Docs deployment fires automatically via the existing docs-deploy-version.yml.

Guard rails

Layer Protection
Tag protection rule (repo settings) Only maintainers can push v* tags
Workflow validates commit is on main Rejects tags on feature branches
Requires existing draft release Prevents empty releases with no merged PRs

Workflow steps

  1. Triggered by push: tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
  2. Validates the tagged commit exists on main
  3. Verifies a release-drafter draft exists
  4. Generates changelog via git-chglog, commits to main
  5. Force-moves version tag and latest to include changelog commit
  6. Publishes the draft release associated with the new tag

SLSA compliance

No workflow_dispatch inputs — the version is derived from the tag ref (github.ref_name), which SLSA considers the build entry point, not a user parameter. Passes CKV_GHA_7.

What this replaces

Manual step Automated
git tag && git push Same — this IS the trigger
Force-move latest tag Workflow handles it
Trigger changelog → review PR → merge → re-tag Direct commit + re-tag
Edit draft release in UI → publish API call publishes draft

Closes #942

Comment thread .github/workflows/release.yml Fixed
Adds a release workflow triggered by pushing a semver tag (v*).
This replaces the manual multi-step release process with a single
git tag push.

Guard rails for public repo safety:
- Validates the tag points to a commit on main
- Requires an existing release-drafter draft (ensures PRs were merged)
- Tag protection rules (configured in repo settings) restrict who can push tags

Workflow steps:
1. Validates tag is on main branch
2. Verifies a draft release exists
3. Generates changelog via git-chglog and commits to main
4. Force-moves version and latest tags to include changelog commit
5. Publishes the draft release with the version tag

Docs deployment triggers automatically via docs-deploy-version.yml
on release publish.

Closes #942
@cloud-game-development-toolkit-bot cloud-game-development-toolkit-bot changed the title feat: add automated release workflow feat: add automated release workflow (tag-triggered) May 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

feat: automate the release process with a single-trigger workflow

2 participants