Wait for a reviewer before tagging the Go module and publishing Kotlin

Merged
JE
14d ago
+12-7

The Go module tag and the Kotlin publish to GitHub Packages now wait for a reviewer, as the crates and npm publishes already do.

Why: crates and npm publish from their own environments with required reviewers. The Go job, which pushes the go/vX module tag, and the Kotlin job, which publishes to GitHub Packages, ran without one. They now run in release-go and release-github-packages.

Releasing now: push the v* tag as before. Each language's workflow then waits at its publish job:

  • Up to 4 approvals per release, one per workflow run: crates and go always; npm and github-packages (Kotlin) only when the tagged commit enables them. Swift publishes nothing gated; SwiftPM reads the tag.
  • Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
  • The go/vX module tag is pushed only after approval.
  • release-github needs no approval of its own. Its orchestration now waits up to 5.5 hours for the publishes. A rejected or unanswered publish fails it. If approvals take longer than that, re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z.

Who approves: a member of sip or cli. Prevent-self-review is on, so whoever pushed the tag can't approve their own release; another member does.

To approve every waiting run for a tag in one pass (GitHub still records one approval per run):

R=basecamp/hey-sdk TAG=vX.Y.Z
gh api repos/$R/compare/main...$TAG --jq .status    # behind or identical: the tag is on main
for id in $(gh run list -R $R --branch "$TAG" --event push --status waiting --json databaseId --jq '.[].databaseId'); do
  ids=$(gh api repos/$R/actions/runs/$id/pending_deployments --jq '[.[]|select(.current_user_can_approve)|.environment.id]')
  [ "$ids" = "[]" ] || gh api -X POST repos/$R/actions/runs/$id/pending_deployments --input - <<<"{\"environment_ids\":$ids,\"state\":\"approved\",\"comment\":\"$TAG\"}" >/dev/null
done

Run it again if a build finishes after the first pass.

Environment: all four environments already exist, require sip or cli, and admit only v* tags, including release-npm, which didn't exist before. Nothing else needs configuring when this merges.

Merging is the owners' call.

Summary by cubic

Go module tagging and Kotlin publishing to GitHub Packages now wait for a reviewer before publishing, matching the existing crates and npm release gates.

Releasing now

  • Requires up to 4 approvals per release: crates and go always; npm and GitHub Packages (Kotlin) only when the tagged commit enables them.
  • make release pushes only vX.Y.Z; the approved release job creates the go/vX module tag, since the module proxy serves a tag the moment it exists.
  • Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
  • Approvers must be sip or cli members; the tag pusher can't approve their own release.
  • The release orchestrator waits up to 5.5 hours for approvals; re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z if approvals take longer.