From 3d1dd4aeb3b7aba5225f9740abae688b38b7c70d Mon Sep 17 00:00:00 2001 From: "John M. Kuchta" Date: Wed, 10 Jun 2026 13:19:55 -0700 Subject: [PATCH] fix(ci): build changelog in regeneration PR, not via protected-branch push (#402) create-release.yml's "Build changelog" step rendered CHANGELOG.md and pushed the commit straight to the release branch (main/beta/httpx). Those branches require status checks, and a bot commit pushed directly has none, so the push was rejected with GH013 (run 27302232244): remote: error: GH013: Repository rule violations found for refs/heads/httpx - 9 of 9 required status checks are expected. The step also ran unconditionally, so it fired even when the release already existed and "Create release" was skipped. The changelog edit never fails the checks; it just never reached them. Move the towncrier build into regenerate-library.yml, right after the version bump, so the rendered CHANGELOG.md and consumed fragments ride the regeneration PR through its required checks (towncrier is in the dev group, already synced). Drop the push step from create-release.yml; the changelog is on the branch before the release is cut. Co-authored-by: Claude Opus 4.8 (1M context) --- .github/workflows/create-release.yml | 34 +++++------------------- .github/workflows/regenerate-library.yml | 14 ++++++++++ 2 files changed, 20 insertions(+), 28 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 22749f99..9c17bb14 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -62,34 +62,12 @@ jobs: exit 1 fi - # Render changelog.d/ fragments into CHANGELOG.md and commit before the - # release is cut. Reuses the version already read from pyproject.toml, so - # there is no separate towncrier version to keep in sync. --generate-notes - # below remains as a fallback for the GitHub release body. - - name: Build changelog - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - run: | - VERSION="${{ steps.version.outputs.version }}" - BRANCH="${{ inputs.branch || github.event.workflow_run.head_branch }}" - - # Nothing to do if there are no fragments to consume. - if ! ls changelog.d/*.md >/dev/null 2>&1; then - echo "No changelog fragments; skipping towncrier build." - exit 0 - fi - - pip install --quiet towncrier - towncrier build --yes --version "$VERSION" - - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add CHANGELOG.md changelog.d/ - if ! git diff --cached --quiet; then - git commit -m "docs: update changelog for $VERSION" - git push origin "HEAD:$BRANCH" - fi - + # CHANGELOG.md is rendered from changelog.d/ fragments inside the + # regeneration PR (see regenerate-library.yml), so it is already on the + # branch by the time the release is cut. Committing/pushing here would + # bypass the branch's required status checks and be rejected by the + # ruleset, so no git write happens in this workflow. --generate-notes + # below produces the GitHub release body. - name: Create release env: GH_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/regenerate-library.yml b/.github/workflows/regenerate-library.yml index 9534bed2..4b73b6c5 100644 --- a/.github/workflows/regenerate-library.yml +++ b/.github/workflows/regenerate-library.yml @@ -101,6 +101,20 @@ jobs: sed -i "s/^version = \".*\"/version = \"$LIBRARY_VERSION\"/" pyproject.toml uv lock + # Render changelog.d/ fragments into CHANGELOG.md here so the update rides + # the regeneration PR (and its required checks) instead of being pushed + # straight to a protected branch later. towncrier is in the dev group, so + # `uv sync --group generator` (default-groups = dev) already installed it. + - name: Build changelog + env: + LIBRARY_VERSION: ${{ github.event.inputs.library_version }} + run: | + if ls changelog.d/*.md >/dev/null 2>&1; then + uv run towncrier build --yes --version "$LIBRARY_VERSION" + else + echo "No changelog fragments; skipping towncrier build." + fi + - name: Commit changes to new branch uses: EndBug/add-and-commit@v10 with: