chore: refuse release.sh from main; require release branch#62
Merged
Conversation
scripts/release.sh used to run on any branch and only hinted "create a PR" when not on main. Running it directly on main accidentally commits a version bump to main without going through PR review, CI, or the merge audit trail — discovered the hard way today (two stray local commits had to be reset). This change adds an explicit guard at the top of the script: if the current branch is `main`, print the proper workflow and exit 1 before touching any file. No env-var escape hatch — normalising the wrong path is what got us here in the first place. For a genuine emergency the user can comment out the guard locally. Also tightens the "Next steps" footer to the single (and now only) correct path — create a release branch, push, PR, merge, push tag. Drops the dead `if BRANCH != main` branch since `BRANCH = main` is now unreachable. Verified by dry-run: - on chore/release-guard: script proceeds past the guard. - on main: script prints the 5-step workflow and exits 1 without modifying package.json / gemini-extension.json / plugin.json.
|
Important Review skippedIgnore keyword(s) in the title. ⛔ Ignored keywords (3)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
`scripts/release.sh` used to run on any branch and only print a hint about creating a PR when not on `main`. Running it from `main` accidentally commits a version bump directly to `main`, bypassing PR review, CI, and the merge audit trail. This happened today — two stray local commits had to be reset.
This PR adds an explicit guard: if HEAD is on `main`, the script prints the proper 5-step workflow and exits 1 before touching any file. No env-var escape hatch — normalising the wrong path is what caused the incident in the first place.
Behaviour
Before: running on main silently committed the version bump to main; a footer suggested a PR but the bump was already on the wrong branch.
After:
```
$ git checkout main
$ ./scripts/release.sh 1.3.9
Error: refusing to run release from 'main' branch.
Version bumps must go through a PR:
```
On any non-main branch, the script proceeds normally.
Also in this PR
Test plan
Follow-up (after this merges)
Re-do the 1.3.9 release the proper way:
Summary by cubic
Add a hard guard in
scripts/release.shto refuse running onmain, forcing releases to go through a release branch and PR. This prevents accidental version bumps onmainand ensures CI and review run every time.main, print a 5-step release workflow, and exit 1 before touching files.if [ "$BRANCH" != "main" ]branch and simplify “Next steps” to the single PR path (push branch, open PR, push tag after merge).Written for commit 468bf4f. Summary will update on new commits.