FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

chore/release: guard CLI release versions by burmudar · Pull Request #1358 · sourcegraph/src-cli · GitHub

/ src-cli Public

chore/release: guard CLI release versions #1358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
burmudar wants to merge 2 commits into
base: main
Choose a base branch
Could not load branches
Branch not found: {{ refName }}

Are you sure you want to change the base?

Some commits from the old base branch may be removed from the timeline, and old review comments may become outdated.
from
+9 −5
Conversation 0 Commits 2 Checks 8 Files changed 1
Open

chore/release: guard CLI release versions #1358

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2d81159
chore/release: guard CLI release versions
burmudar Jul 31, 2026
c3b01ee
Merge branch 'main' into wb/guard-release-version
burmudar Aug 4, 2026
File filter

Filter by extension

Filter by extension .md  (1) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
14 changes: 9 additions & 5 deletions .agents/skills/release/SKILL.md
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,11 @@ For version inference:

## Hard stops

Stop and ask before continuing if:
Stop before continuing if any condition below applies. Ask for approval or remediation only when that can resolve the condition; the Sourcegraph version guard cannot be overridden.

- The working tree is dirty in a way not caused by this release work.
- The target of a major or minor release has a greater major/minor version than the latest stable Sourcegraph release. Warn that this is typically an error because only patch releases should advance independently, then refuse to create or push the release tag. Do not allow confirmation to override this guard.
- The latest stable Sourcegraph release cannot be fetched or its semantic version cannot be determined. Do not infer it from memory, local src-cli tags, or previously fetched output.
- A release branch or tag would be pushed without explicit approval.
- A force-push or tag replacement would be needed.
- Trivy or required tests fail before tagging or pushing.
Expand All @@ -55,7 +57,8 @@ Before starting the release work:

1. Make sure the working tree is clean with `git status`.
2. Fetch current refs and tags with `git fetch --all --tags --prune`.
3. Run Trivy before creating final release artifacts, and earlier when the release is vulnerability-driven.
3. Before creating a major or minor release tag, run `gh release list --repo sourcegraph/sourcegraph --exclude-drafts --exclude-pre-releases --limit 1 --json tagName` to fetch the latest stable release directly from `sourcegraph/sourcegraph`. Parse the returned tag as semantic versioning and compare the `<major>.<minor>` components. The src-cli release line must be behind or equal to the Sourcegraph release line. Ignore patch components for this check, because src-cli patch releases may advance independently. Report the Sourcegraph version and its `https://github.com/sourcegraph/sourcegraph/releases/tag/<tag>` URL in the release plan. If the command, lookup, or parsing fails, stop. If the src-cli release line is ahead, report both versions, explain that this usually indicates an erroneous release plan, and stop without creating or pushing the tag.
4. Run Trivy before creating final release artifacts, and earlier when the release is vulnerability-driven.
- For this repository, use `mise x trivy -- trivy fs --exit-code 1 --severity HIGH,CRITICAL`.
- Use a different documented Trivy command only if the repository adds one.
- If running from a temporary worktree, `mise` may require trusting that worktree's `mise.toml`. Run `mise trust -y <worktree>/mise.toml` when needed, then remove or untrust temporary state during cleanup.
Expand All @@ -75,9 +78,10 @@ Use the same workflow for patch, minor, and major releases. The release type mai
5. Apply the release-type commit selection rules; use `git cherry-pick -x <sha>` for commits ported onto an existing release branch.
6. Resolve conflicts carefully and keep the release branch limited to selected commits and release-process changes.
7. Validate every release branch after porting changes.
8. Before tagging, show the release contents summary and ask `Proceed?`.
9. Tag locally on the release branch.
10. Push the release branch and tag only when requested or required by the release process and approved by the user.
8. For a major or minor release, repeat the live `sourcegraph/sourcegraph` release lookup and compatibility check immediately before presenting the pre-tag summary so a stale earlier result cannot permit an invalid tag. Refuse to tag if the lookup fails.
9. Before tagging, show the release contents summary and ask `Proceed?`.
10. Tag locally on the release branch only if the compatibility guard passes.
11. Push the release branch and tag only when requested or required by the release process and approved by the user.

Use this pre-tag summary format:

Expand Down
Loading
Back | FazBrowse Home | New Git URL