From 6caa5093f271a3e2ab474926077e4785375d6be7 Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sat, 25 Oct 2025 20:41:58 -0600 Subject: [PATCH 1/6] fix: specific permissions to bypass the release --- .github/instructions/copilot.instructions.md | 35 ++++++++++++++++++-- .github/workflows/release.yml | 2 +- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/.github/instructions/copilot.instructions.md b/.github/instructions/copilot.instructions.md index 472a6de..ecd5478 100644 --- a/.github/instructions/copilot.instructions.md +++ b/.github/instructions/copilot.instructions.md @@ -348,7 +348,6 @@ test('SquirrelListProvider.loadSquirrels() should update state', () async { **Characteristics**: - **Moderate Speed**: Execute in hundreds of milliseconds -- **Partial Integration**: Real database, real repositories, real models - **No UI**: Run in Dart VM without Flutter UI framework - **Database State**: Use in-memory or test databases @@ -609,4 +608,36 @@ Manual testing alone is insufficient. If a behavior can break, it must have auto - Maintain an internal log of sources and permissions for any external material incorporated into the codebase or documentation. - When in doubt about whether material is permissible to use, escalate to the project owner or legal counsel before adding it to the repository. -Failure to follow these rules is not permitted; always prioritize respecting creators’ rights and giving proper credit. \ No newline at end of file +Failure to follow these rules is not permitted; always prioritize respecting creators’ rights and giving proper credit. + +## Automated Pull Request Workflow + +To create a pull request for code changes, follow this standardized process: + +1. **Create a new branch** + - Use a descriptive branch name based on the change, e.g. `fix/release-script-paths` or `feature/widget-improvements`. + - Example: `git checkout -b fix/release-script-paths main` + +2. **Make all relevant changes** + - Edit, add, or remove files as required for the feature or fix. + - Ensure all changes are tested and meet project standards. + +3. **Create a semantic commit** + - Use a clear, conventional commit message describing the change and affected scope. + - Example: `git commit -m "fix(ci): use absolute paths for release script checksum steps"` + +4. **Push the branch to remote** + - Example: `git push --set-upstream origin fix/release-script-paths` + +5. **Create a pull request using GitHub CLI** + - Use the `gh` CLI to open a PR from your branch to `main`. + - Example: + gh pr create --base main --head fix/release-script-paths --title "fix(ci): use absolute paths for release script checksum steps" --body "This PR fixes path navigation errors in the release script by using absolute paths for checksum generation, ensuring robust operation in CI environments." + +6. **Enable auto-merge for the pull request (using gh CLI)** + - Example: + gh pr merge --auto --squash + - This will automatically squash and merge the PR when all required checks pass. + +> **Note:** Always ensure your branch is up to date with `main` before creating a PR. Rebase or merge as needed. +> All changes must be covered by appropriate tests and follow semantic commit conventions. \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b0908a..2a2c768 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - persist-credentials: false + token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Node.js uses: actions/setup-node@v4 From 126671369d00ef21f7396fb390911d65f7ae9e37 Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sat, 25 Oct 2025 20:45:33 -0600 Subject: [PATCH 2/6] fix(ci): remove git plugin to avoid bypass requirement Remove @semantic-release/git plugin so version bumps aren't committed back to main, eliminating the need for branch protection bypass. Tags and releases are still created normally. --- .releaserc.json | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.releaserc.json b/.releaserc.json index 2fbb2af..5603811 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -56,13 +56,7 @@ "prepareCmd": "bash scripts/prepare-release.sh ${nextRelease.version}" } ], - [ - "@semantic-release/git", - { - "assets": ["CHANGELOG.md", "pubspec.yaml"], - "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" - } - ], + [ "@semantic-release/github", { From be5f67c09e5f5706772757c46361d715043938ef Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sat, 25 Oct 2025 20:48:24 -0600 Subject: [PATCH 3/6] fix(ci): restore git plugin and use PAT for releases --- .github/workflows/release.yml | 4 ++-- .releaserc.json | 9 ++++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2a2c768..436cd25 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ secrets.SEMANTIC_RELEASE_PAT }} - name: Set up Node.js uses: actions/setup-node@v4 @@ -65,5 +65,5 @@ jobs: # Semantic Release (analyzes commits, builds artifacts, creates release with assets) - name: Run semantic-release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_PAT }} run: npx semantic-release diff --git a/.releaserc.json b/.releaserc.json index 5603811..3faa9cd 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -50,7 +50,14 @@ } ], [ - "@semantic-release/exec", + "@semantic-release/git", + { + "assets": ["CHANGELOG.md", "pubspec.yaml"], + "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" + } + ], + [ + "@semantic-release/github", { "verifyConditionsCmd": "flutter --version", "prepareCmd": "bash scripts/prepare-release.sh ${nextRelease.version}" From d7390d228ab4f4d3ac5ea6eb113e038a8b77600a Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sat, 25 Oct 2025 20:49:37 -0600 Subject: [PATCH 4/6] Update .github/instructions/copilot.instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .github/instructions/copilot.instructions.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/instructions/copilot.instructions.md b/.github/instructions/copilot.instructions.md index ecd5478..91cbb3c 100644 --- a/.github/instructions/copilot.instructions.md +++ b/.github/instructions/copilot.instructions.md @@ -636,7 +636,9 @@ To create a pull request for code changes, follow this standardized process: 6. **Enable auto-merge for the pull request (using gh CLI)** - Example: + ```bash gh pr merge --auto --squash + ``` - This will automatically squash and merge the PR when all required checks pass. > **Note:** Always ensure your branch is up to date with `main` before creating a PR. Rebase or merge as needed. From 7753a8a11bdcae5b207008bc913d830cd435ef0a Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sat, 25 Oct 2025 20:50:14 -0600 Subject: [PATCH 5/6] fix(ci): correct plugin order and remove duplicate github plugin Move verifyConditionsCmd and prepareCmd to @semantic-release/exec plugin where they belong, and remove duplicate @semantic-release/github declaration. --- .releaserc.json | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.releaserc.json b/.releaserc.json index 3faa9cd..2fbb2af 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -50,20 +50,19 @@ } ], [ - "@semantic-release/git", + "@semantic-release/exec", { - "assets": ["CHANGELOG.md", "pubspec.yaml"], - "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" + "verifyConditionsCmd": "flutter --version", + "prepareCmd": "bash scripts/prepare-release.sh ${nextRelease.version}" } ], [ - "@semantic-release/github", + "@semantic-release/git", { - "verifyConditionsCmd": "flutter --version", - "prepareCmd": "bash scripts/prepare-release.sh ${nextRelease.version}" + "assets": ["CHANGELOG.md", "pubspec.yaml"], + "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" } ], - [ "@semantic-release/github", { From 04336bb8dc1072a2ec37a1dbf7164fc5d3bfc501 Mon Sep 17 00:00:00 2001 From: Michiel Bugher Date: Sun, 26 Oct 2025 11:54:16 -0600 Subject: [PATCH 6/6] fix(ci): use GitHub App token for releases Replace PAT with GitHub App authentication using actions/create-github-app-token. This allows the fostersquirrel-release-bot app to bypass branch protection while keeping manual pushes protected. --- .github/workflows/release.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 436cd25..1c5ec60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,12 +17,20 @@ jobs: timeout-minutes: 60 steps: + # Generate GitHub App token for authentication + - name: Generate GitHub App Token + id: generate-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + # Setup - name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.SEMANTIC_RELEASE_PAT }} + token: ${{ steps.generate-token.outputs.token }} - name: Set up Node.js uses: actions/setup-node@v4 @@ -65,5 +73,5 @@ jobs: # Semantic Release (analyzes commits, builds artifacts, creates release with assets) - name: Run semantic-release env: - GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_PAT }} + GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }} run: npx semantic-release