add workflow for manually finalizing release by stempler · Pull Request #1498 · halestudio/hale

stempler · 2026-04-23T09:44:22Z

No description provided.

github-actions · 2026-04-23T09:44:33Z

This PR cannot be merged yet because a required label is missing: challenged, renovate/patch, renovate/minor. It needs to be added before this PR can be merged.

Copilot

Pull request overview

Adds a manual “Finalize Release” GitHub Actions workflow and refactors existing release steps into reusable workflows, with a small robustness tweak to the post-release script.

Changes:

Introduce release-finalize.yml to manually run post-release bump, product publishing, and Windows installer build.
Extract “publish products” and “Windows build” into reusable workflow_call workflows and consume them from release.yml.
Update build/post-release.sh to avoid failing when there are no staged/unstaged diffs after running the snapshot task; ignore .worktrees/.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
build/post-release.sh	Adds a “no changes” guard around commit/push after `setSnapshot`.
.gitignore	Ignores `.worktrees/` directory.
.github/workflows/windows-build.yml	New reusable workflow for building/uploading the Windows installer.
.github/workflows/release.yml	Refactors publish/windows jobs to call reusable workflows.
.github/workflows/release-finalize.yml	New manually-triggered workflow to finalize an existing release/tag.
.github/workflows/publish-products.yml	New reusable workflow for building products, uploading release assets, and updating the site.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-23T10:09:27Z

+        description: "Build and publish Windows installer"
+
+concurrency:
+  group: publish-${{ github.ref }}


concurrency.group is based on github.ref, but this workflow is workflow_dispatch and can be started from different refs. That means two runs for the same release (or a run overlapping with the main release.yml workflow) can bypass the intended single-publish lock and run concurrently, potentially clobbering release assets / update-site uploads. Consider using a ref-independent key (e.g., publish or publish-${{ inputs.version }}) so all finalize runs serialize correctly.

Suggested change

group: publish-${{ github.ref }}

group: publish-${{ inputs.version }}

Copilot · 2026-04-23T10:09:28Z

  publish-products:
    name: Publish products and update site
-    runs-on: ubuntu-latest
    needs: [release]
    if: ${{ !inputs.dryRun && needs.release.outputs.release-published != 'false' }}
-    steps:
-      - name: Setup Maven
-        uses: s4u/setup-maven-action@ba34de01b7f4ba2ab8e2860df8993a29f4477056 # v1.20.0
-        with:
-          java-version: 17
-          java-distribution: temurin
-          maven-version: 3.9.6
-          checkout-ref: refs/tags/v${{needs.release.outputs.release-version}} # check out release tag
-
-      - name: Install genisoimage # required for Mac build
-        run: sudo apt-get install -y genisoimage
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-
-      - name: Install AWS CLI # Required for uploading update site
-        uses: unfor19/install-aws-cli-action@f5b46b7f32cf5e7ebd652656c5036bf83dd1e60c # 1.0.8
-        with:
-          version: 1
-
-      - name: Clean
-        run: ./build.sh clean
-        working-directory: ./build
-
-      - name: Build products
-        run: |
-          ./build.sh product --arch x86_64 --os linux HALE
-          ./build.sh product --arch x86_64 --os windows HALE
-          ./build.sh product --arch x86_64 --os macosx HALE
-          ./build.sh product --arch x86_64 --os linux --publish Infocenter
-        working-directory: ./build
-
-        # use GitHub CLI to upload asset to release
-        # see https://cli.github.com/manual/gh_release_upload
-      - name: Add HALE products to release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          echo "Adding to release assets..."
-          gh release upload v${{needs.release.outputs.release-version}} build/target/*.tar.gz --repo ${{ github.repository }}
-          gh release upload v${{needs.release.outputs.release-version}} build/target/*.zip --repo ${{ github.repository }}
-          gh release upload v${{needs.release.outputs.release-version}} build/target/*.dmg --repo ${{ github.repository }}
-        shell: bash
-
-      - name: Upload update site
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.BUILD_ARCHIVE_ACCESS_KEY }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.BUILD_ARCHIVE_SECRET_KEY }}
-        run: ./upload-site.sh
-        working-directory: ./build
-
-        # https://github.com/marketplace/actions/slack-notify-build
-      - name: Notify failure to Slack
-        if: failure()
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_NOTIFICATIONS_BOT_TOKEN }}
-        uses: voxmedia/github-action-slack-notify-build@3665186a8c1a022b28a1dbe0954e73aa9081ea9e # v1.6.0
-        with:
-          channel: build-failures
-          status: FAILED
-          color: danger
+    uses: ./.github/workflows/publish-products.yml
+    with:
+      version: ${{ needs.release.outputs.release-version }}
+    secrets: inherit


These jobs call reusable workflows that upload release assets via gh release upload. Unless the repo/org default GITHUB_TOKEN permissions are set to write, this can fail with 403 because the caller job does not grant contents: write. Please add explicit permissions: contents: write (job-level here, or workflow-level) for publish-products/windows-build so the called workflows can upload assets reliably.

Copilot · 2026-04-23T10:09:28Z

+  publish-products:
+    name: Publish products and update site
+    needs: [verify-tag]
+    if: ${{ inputs.publishProducts }}
+    uses: ./.github/workflows/publish-products.yml
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit


publish-products and windows-build call reusable workflows that run gh release upload using ${{ github.token }}. The token’s permissions are controlled by the caller job, but these jobs don’t declare permissions: contents: write, so uploads can fail when default workflow permissions are read-only. Add explicit job (or workflow) permissions for release-asset uploads.

github-actions · 2026-04-23T10:13:41Z

hale studio builds for this pull request:

Build triggered for commit c48d768.
Artifacts are retained for 14 days.

stempler added 2 commits April 23, 2026 10:45

chore: add .worktrees to .gitignore

ea34e40

ci: use reusable workflows for publish-products and windows-build

b6b1703

stempler requested a review from Copilot April 23, 2026 09:44

Copilot started reviewing on behalf of stempler April 23, 2026 09:44 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

Comment thread build/post-release.sh Outdated

Comment thread .github/workflows/release-finalize.yml

stempler force-pushed the feature/release-finalize branch from ed529d4 to b4299b2 Compare April 23, 2026 10:01

stempler requested a review from Copilot April 23, 2026 10:04

Copilot started reviewing on behalf of stempler April 23, 2026 10:04 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

ci: add release-finalize workflow for manual post-release recovery

cb2760f

stempler force-pushed the feature/release-finalize branch from b4299b2 to cb2760f Compare April 23, 2026 11:23

stempler merged commit 7348cf4 into master Apr 23, 2026
5 of 6 checks passed

stempler deleted the feature/release-finalize branch April 23, 2026 11:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add workflow for manually finalizing release#1498

add workflow for manually finalizing release#1498
stempler merged 3 commits intomasterfrom
feature/release-finalize

stempler commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 23, 2026

Uh oh!

Copilot AI Apr 23, 2026

Uh oh!

Copilot AI Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	group: publish-${{ github.ref }}
	group: publish-${{ inputs.version }}

Conversation

stempler commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Apr 23, 2026 •

edited

Loading