fix(ci): build changelog in regeneration PR, not via protected-branch push - #402
Merged
Merged
Conversation
… push
create-release.yml's "Build changelog" step rendered CHANGELOG.md and pushed
the commit straight to the release branch (main/beta/httpx). Those branches
require status checks, and a bot commit pushed directly has none, so the push
was rejected with GH013 (run 27302232244):
remote: error: GH013: Repository rule violations found for refs/heads/httpx
- 9 of 9 required status checks are expected.
The step also ran unconditionally, so it fired even when the release already
existed and "Create release" was skipped. The changelog edit never fails the
checks; it just never reached them.
Move the towncrier build into regenerate-library.yml, right after the version
bump, so the rendered CHANGELOG.md and consumed fragments ride the regeneration
PR through its required checks (towncrier is in the dev group, already synced).
Drop the push step from create-release.yml; the changelog is on the branch
before the release is cut.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jun 10, 2026
TKIPisalegacycipher
added a commit
that referenced
this pull request
Jun 10, 2026
… push (#402) (#403) create-release.yml's "Build changelog" step rendered CHANGELOG.md and pushed the commit straight to the release branch (main/beta/httpx). Those branches require status checks, and a bot commit pushed directly has none, so the push was rejected with GH013 (run 27302232244): remote: error: GH013: Repository rule violations found for refs/heads/httpx - 9 of 9 required status checks are expected. The step also ran unconditionally, so it fired even when the release already existed and "Create release" was skipped. The changelog edit never fails the checks; it just never reached them. Move the towncrier build into regenerate-library.yml, right after the version bump, so the rendered CHANGELOG.md and consumed fragments ride the regeneration PR through its required checks (towncrier is in the dev group, already synced). Drop the push step from create-release.yml; the changelog is on the branch before the release is cut. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TKIPisalegacycipher
added a commit
that referenced
this pull request
Jun 10, 2026
… push (#402) (#404) create-release.yml's "Build changelog" step rendered CHANGELOG.md and pushed the commit straight to the release branch (main/beta/httpx). Those branches require status checks, and a bot commit pushed directly has none, so the push was rejected with GH013 (run 27302232244): remote: error: GH013: Repository rule violations found for refs/heads/httpx - 9 of 9 required status checks are expected. The step also ran unconditionally, so it fired even when the release already existed and "Create release" was skipped. The changelog edit never fails the checks; it just never reached them. Move the towncrier build into regenerate-library.yml, right after the version bump, so the rendered CHANGELOG.md and consumed fragments ride the regeneration PR through its required checks (towncrier is in the dev group, already synced). Drop the push step from create-release.yml; the changelog is on the branch before the release is cut. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TKIPisalegacycipher
added a commit
that referenced
this pull request
Jun 10, 2026
The "Build changelog" step that pushed to the branch was removed in #402, so this workflow no longer writes to contents. Update the stale header comment and lower permissions from contents: write to contents: read (checkout + the gh release view read are read-only; the release itself uses the App token). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TKIPisalegacycipher
added a commit
that referenced
this pull request
Jun 10, 2026
The "Build changelog" step that pushed to the branch was removed in #402, so this workflow no longer writes to contents. Update the stale header comment and lower permissions from contents: write to contents: read (checkout + the gh release view read are read-only; the release itself uses the App token). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TKIPisalegacycipher
added a commit
that referenced
this pull request
Jun 10, 2026
The "Build changelog" step that pushed to the branch was removed in #402, so this workflow no longer writes to contents. Update the stale header comment and lower permissions from contents: write to contents: read (checkout + the gh release view read are read-only; the release itself uses the App token). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
Run 27302232244 failed in
create-release.yml→ Build changelog:The step rendered
CHANGELOG.mdand pushed the commit directly to the release branch.main/beta/httpxrulesets require status checks; a bot commit pushed straight to the branch has none → rejected. The step also ran unconditionally (noexistsguard), so it fired even though4.1.0b1already existed and Create release was correctly skipped. The changelog content never fails the checks; it just never reaches them.Fix
CHANGELOG.md+ consumed fragments land in the same regeneration PR and ride its required checks.towncrieris in thedevgroup (default-groups = ["dev"]), already installed byuv sync --group generator.--generate-notes.No bypass actor needed — the changelog change now goes through the normal checks instead of around them.
Distribution
Branches have drifted, but the removed Build changelog step is byte-identical across
main/beta/httpx, and the regen insertion is in a shared region — cherry-picks cleanly. Will cherry-pick tobetaandhttpxafter merge (never merge main down).Follow-up (not in this PR)
changelog.d/+httpx-migration.changed.mdis still unconsumed onorigin/httpx(its release was already cut). It'll fold into the next regen PR under this flow.