Repository navigation
[release-intent] bump release after PR #132 #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Applies a merged pull request's release-intent block to the version files. | |
| # | |
| # Kept in its own file precisely because it holds a credential. ci.yml and | |
| # release-intent-check.yml run on pull requests from forks and must stay free | |
| # of secrets; this one is only ever reachable from a push to an integration | |
| # branch, which requires write access. Do not add a pull_request or | |
| # pull_request_target trigger here. | |
| # | |
| # Runs on `develop`, not `main`: one merge produces one apply, and the | |
| # Applies-PR trailer assumes exactly that. A release cut merges an accumulated | |
| # range into `main`, which this would see as a single push covering many pull | |
| # requests — and the script cannot aggregate them. The cut carries the already | |
| # applied bumps forward instead. | |
| name: Release intent | |
| on: | |
| push: | |
| branches: [develop] | |
| permissions: | |
| contents: read | |
| # Concurrent applies are handled by the script, not here: it commits with | |
| # `force: false` and re-reads the ref when the branch moved underneath it. | |
| # Do not add a `concurrency:` group — GitHub keeps only one pending run and | |
| # cancels any earlier one, so a burst of merges silently loses bumps. | |
| jobs: | |
| apply: | |
| name: Apply | |
| runs-on: ubuntu-latest | |
| # The bot's own push triggers this workflow: an app installation token, | |
| # unlike GITHUB_TOKEN, does start workflow runs. The script exits early | |
| # on its own commits; this skips them without booting a runner first. | |
| if: ${{ !startsWith(github.event.head_commit.message, '[release-intent]') }} | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| # An installation token, not a PAT: it expires in an hour and is | |
| # scoped to this repository. Granted `contents: write` and | |
| # deliberately NOT the Workflows permission, so a compromise of this | |
| # job cannot rewrite .github/workflows. | |
| - name: Mint an app token | |
| id: app-token | |
| uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 | |
| with: | |
| app-id: ${{ vars.RELEASE_INTENT_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_INTENT_APP_PRIVATE_KEY }} | |
| - name: Apply release intent | |
| env: | |
| RELEASE_INTENT_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: python3 scripts/release-intent/apply_pr.py |