Support immutable releases#374
Merged
martincostello merged 6 commits intomainfrom Dec 17, 2025
Merged
Conversation
Run for all PR branches, not just main.
Refactor the release workflow to support immutable releases by adding a workflow to create a new tag, build that tag, create a release draft for it, then when undrafted publish the NuGet packages. Resolves #366.
Allow AGPL for the create-github-app-token action.
There was a problem hiding this comment.
Pull request overview
This PR refactors the CI/CD processes to support immutable releases through a three-step workflow: creating a release tag, building and drafting a release, then publishing packages after human review.
Key changes:
- Introduces new
publish-release.ymlworkflow to create release tags - Adds
publish-packages.ymlworkflow to publish NuGet packages after release approval - Refactors
ci.ymlto create draft releases with checksums and attached artifacts - Removes branch restrictions from workflow triggers to support multiple branches
- Adds comprehensive release documentation in
RELEASING.md
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| RELEASING.md | New documentation describing the immutable release process with step-by-step instructions |
| .github/workflows/publish-release.yml | New workflow that creates release tags, auto-incrementing versions if needed |
| .github/workflows/publish-packages.yml | New workflow that downloads, verifies, and publishes NuGet packages from releases |
| .github/workflows/ci.yml | Refactored to create draft releases with checksums and attach artifacts instead of directly publishing |
| .github/workflows/oats.yml | Removed branch restriction to allow PRs from any branch |
| .github/workflows/lint.yml | Removed branch restriction to allow PRs from any branch |
| .github/workflows/dotnet-format.yml | Removed branch restriction to allow PRs from any branch |
| .github/workflows/dependency-review.yml | Removed branch restriction to allow PRs from any branch |
| .github/workflows/codeql.yml | Removed branch restriction to allow PRs from any branch |
- Fix link. - Update wording. - Explicitly set `GH_TOKEN`.
Test the GitHub app's permissions are set up correctly to generate a GitHub token.
Reverts 1b34ed1.
matt-hensley
approved these changes
Dec 16, 2025
This was referenced Jan 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Refactor CI/CD processes to support using immutable releases.
The process is now:
publish-release.yml, which creates a tagci.ymlruns, attaching the NuGet packages and SBOM to a draft release for the tag, which have their checksums computedpublish-packages.ymlruns and the NuGet packages are published to NuGet.orgTODO
Add secrets to VaultUpdate GitHub token broker configurationVerify generating GitHub tokensci.yml and publish-release.ymlMerge requirement checklist
Unit tests added/updatedCHANGELOG.mdupdatedChanges in public API reviewed (if applicable)