Repository navigation
Cut patch releases automatically for dependency updates - #50
Merged
Merged
Conversation
Bundled dependency fixes only reached users when someone remembered to release. Weekly, release a patch and move the major tag if dist/ changed since the last release, src/ and action.yml did not, and main is green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency fixes in
dist/only reach@v4users after a manual release. For example, the undici CVE fixes from #43 are on main, but v4.0.1 still ships the vulnerable undici 6.28.0.This adds a Patch Release workflow that runs every Monday at 06:00 UTC and can also be started by hand. It releases only if all of these hold:
dist/changed since the latestvX.Y.Ztagsrc/andaction.ymldid not change; feature work still goes throughscript/release, so it can get the right versionWhen they do, the workflow tags the next patch the same way
script/releasedoes (annotated, "vX.Y.Z Release"), moves the major tag (v4), and creates a GitHub release with generated notes.I ran the check logic against the current main: it would release v4.0.2. After merging, I'll start it once by hand to ship that release.
🤖 Generated with Claude Code