Wait for a reviewer before tagging the Go module and publishing Kotlin

Merged
JE
18d ago
+6-1

The Go module tag and the Kotlin publish to GitHub Packages now wait for a reviewer, as the other registry publishes already do.

Why: RubyGems, npm, PyPI and crates already publish from their own environments with required reviewers. The Go job, which pushes the go/vX module tag, and the Kotlin job, which publishes to GitHub Packages, ran without one, so a tag push released those two with no one approving. They now run in release-go and release-github-packages.

Releasing now: push the v* tag as before. Each language's workflow then waits at its publish job:

  • 6 approvals per release, one per workflow run: rubygems, npm, pypi, crates, github-packages (Kotlin) and go. Swift publishes nothing gated; SwiftPM reads the tag.
  • Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
  • The go/vX module tag is pushed only after approval.
  • release-github needs no approval of its own. It still creates the notes-only GitHub Release once every publish run for the tag has succeeded, and now waits up to 5.5 hours for them (was 30 minutes). A rejected or unanswered publish fails it. If approvals take longer than that, re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z.

Who approves: a member of sip or cli. Prevent-self-review is on, so whoever pushed the tag can't approve their own release; another member does.

To approve every waiting run for a tag in one pass (GitHub still records one approval per run):

R=basecamp/basecamp-sdk TAG=vX.Y.Z
gh api repos/$R/compare/main...$TAG --jq .status    # behind or identical: the tag is on main
for id in $(gh run list -R $R --branch "$TAG" --event push --status waiting --json databaseId --jq '.[].databaseId'); do
  ids=$(gh api repos/$R/actions/runs/$id/pending_deployments --jq '[.[]|select(.current_user_can_approve)|.environment.id]')
  [ "$ids" = "[]" ] || gh api -X POST repos/$R/actions/runs/$id/pending_deployments --input - <<<"{\"environment_ids\":$ids,\"state\":\"approved\",\"comment\":\"$TAG\"}" >/dev/null
done

Run it again if a build finishes after the first pass.

Environment: all six environments already exist, require sip or cli, and admit only v* tags (release-npm and release-rubygems no longer admit main). Nothing else needs configuring when this merges.

Merging is the owners' call.

Summary by cubic

Requires reviewer approval before pushing the go/vX module tag and publishing Kotlin to GitHub Packages, as the other registry publishes already do. The notes-only GitHub Release job now waits up to 5.5 hours for all publishes instead of 30 minutes, since each can be held pending approval.