From b19a23f78309ddc54dda466bb2b08aa003f66323 Mon Sep 17 00:00:00 2001 From: "John M. Kuchta" Date: Wed, 10 Jun 2026 13:19:55 -0700 Subject: [PATCH] fix(ci): build changelog in regeneration PR, not via protected-branch push (#402) create-release.yml's "Build changelog" step rendered CHANGELOG.md and pushed the commit straight to the release branch (main/beta/httpx). Those branches require status checks, and a bot commit pushed directly has none, so the push was rejected with GH013 (run 27302232244): remote: error: GH013: Repository rule violations found for refs/heads/httpx - 9 of 9 required status checks are expected. The step also ran unconditionally, so it fired even when the release already existed and "Create release" was skipped. The changelog edit never fails the checks; it just never reached them. Move the towncrier build into regenerate-library.yml, right after the version bump, so the rendered CHANGELOG.md and consumed fragments ride the regeneration PR through its required checks (towncrier is in the dev group, already synced). Drop the push step from create-release.yml; the changelog is on the branch before the release is cut. Co-authored-by: Claude Opus 4.8 (1M context) --- .github/workflows/create-release.yml | 34 +++++------------------- .github/workflows/regenerate-library.yml | 14 ++++++++++ 2 files changed, 20 insertions(+), 28 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index aacedac5..1ad10e3b 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -67,34 +67,12 @@ jobs: exit 1 fi - # Render changelog.d/ fragments into CHANGELOG.md and commit before the - # release is cut. Reuses the version already read from pyproject.toml, so - # there is no separate towncrier version to keep in sync. --generate-notes - # below remains as a fallback for the GitHub release body. - - name: Build changelog - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - run: | - VERSION="${{ steps.version.outputs.version }}" - BRANCH="${{ inputs.branch || github.event.workflow_run.head_branch }}" - - # Nothing to do if there are no fragments to consume. - if ! ls changelog.d/*.md >/dev/null 2>&1; then - echo "No changelog fragments; skipping towncrier build." - exit 0 - fi - - pip install --quiet towncrier - towncrier build --yes --version "$VERSION" - - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add CHANGELOG.md changelog.d/ - if ! git diff --cached --quiet; then - git commit -m "docs: update changelog for $VERSION" - git push origin "HEAD:$BRANCH" - fi - + # CHANGELOG.md is rendered from changelog.d/ fragments inside the + # regeneration PR (see regenerate-library.yml), so it is already on the + # branch by the time the release is cut. Committing/pushing here would + # bypass the branch's required status checks and be rejected by the + # ruleset, so no git write happens in this workflow. --generate-notes + # below produces the GitHub release body. - name: Create release env: GH_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/regenerate-library.yml b/.github/workflows/regenerate-library.yml index f0eeeab6..68a70f6d 100644 --- a/.github/workflows/regenerate-library.yml +++ b/.github/workflows/regenerate-library.yml @@ -101,6 +101,20 @@ jobs: sed -i "s/^version = \".*\"/version = \"$LIBRARY_VERSION\"/" pyproject.toml uv lock + # Render changelog.d/ fragments into CHANGELOG.md here so the update rides + # the regeneration PR (and its required checks) instead of being pushed + # straight to a protected branch later. towncrier is in the dev group, so + # `uv sync --group generator` (default-groups = dev) already installed it. + - name: Build changelog + env: + LIBRARY_VERSION: ${{ github.event.inputs.library_version }} + run: | + if ls changelog.d/*.md >/dev/null 2>&1; then + uv run towncrier build --yes --version "$LIBRARY_VERSION" + else + echo "No changelog fragments; skipping towncrier build." + fi + - name: Commit changes to new branch uses: EndBug/add-and-commit@v10 with: