1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: Release Please
# Keeps the version, the CHANGELOG and the release tag in step, so none of
# those is a thing anyone has to remember.
#
# On every push to `main`, release-please reads the conventional commits since
# the last release and maintains a single open "Release PR" that accumulates
# them. That PR bumps the version in Cargo.toml (and Cargo.lock) and writes the
# CHANGELOG. Merging it creates the `vX.Y.Z` tag, which is what `release.yml`
# triggers on to publish.
#
# The PR is the review step. A misconfigured version bump or a wrong changelog
# shows up as a diff to approve, not as a bad release — nothing reaches a
# registry until that PR is merged and the publish workflow's `release`
# environment gate is passed.
#
# This workflow deliberately does NOT publish and holds no registry
# credentials. `release.yml` does that over OIDC; keeping a third-party action
# out of the job that holds the publish identity is the point of the split.
on:
push:
branches:
# Lets a maintainer force a refresh of the Release PR without a new commit.
workflow_dispatch:
permissions:
contents: read
# One release PR at a time; a second push supersedes the first rather than
# racing it.
concurrency:
group: release-please
cancel-in-progress: false
jobs:
release-please:
name: Maintain the release PR
runs-on: ubuntu-26.04
permissions:
# Create the tag + GitHub Release on merge, and open/update the PR.
contents: write
pull-requests: write
steps:
# The token matters. Events raised with the default GITHUB_TOKEN do not
# start workflow runs (GitHub's recursion guard), so a v* tag pushed under
# it would never reach release.yml: the tag and GitHub Release would be
# created and nothing would publish, with no error. brain-db hit exactly
# this on its v0.1.0 — tag created, release published, no image built —
# and force-pushing the identical tag by hand fired the workflow
# immediately, isolating the token as the cause.
#
# Falls back to GITHUB_TOKEN so the Release PR is still managed if the
# secret is absent, but then the tag will NOT publish and release.yml must
# be run by hand.
- uses: googleapis/release-please-action@v5
with:
token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
config-file: release-please-config.json
manifest-file: .release-please-manifest.json