The default Go build and test step has no way to pass build tags.
A repository that needs tags, such as fts5, fails its scheduled run.
The new build-tags input defaults to an empty string.
With tags set, the step must run go build and go test with -tags.
It also sets CGO_ENABLED=1, as go-pr.yaml does.
Without tags, the commands stay unchanged.
The go-test-command input still replaces the default commands.
A dependency update can raise the go directive past the input range, which
made the test step fail with GOTOOLCHAIN=local. Raise the version to the
merged go.mod and let the test step fetch a toolchain when one is needed.
A lockfile changed on both sides merges as text and can come out broken,
so a tested merge differs from the merge that lands. Skip the branch and
let Renovate regenerate it on the next run.
The Renovate autoupdate workflow merged each update branch with the
github-actions bot identity. It now uses [email protected], the same
author as the cluster Renovate runner.
The GitHub App reads statuses but cannot write them. Renovate posts a
renovate/stability-days status on each branch for minimumReleaseAge. The
403 aborted the run as "repository changed" right after the first
branch was created. Turn the Renovate status checks off. minimumReleaseAge
still holds a release back.
scripts/check-actions.sh runs actionlint and checks that every external
uses: reference resolves. The validate workflow runs it, then runs the
go-test and node-build actions and the node-pr workflow against small
fixtures, so a bump of an action they use is exercised before it merges.
renovate.json bumps the actions this repository uses. Minor and patch
bumps merge themselves once validate is green. Major bumps wait for a
person, because every consumer calls these actions at @main. The same
script runs as a Renovate post-upgrade task and marks a failing branch so
no PR opens.
Encore adds imports at build time, so go mod tidy prunes go.sum entries
that the Encore build needs, and every batch failed with a missing go.sum
entry. Add go-mod-tidy, on by default, so an Encore app can turn it off.
Renovate wrote the lockfile with its own pnpm, in a form the pinned pnpm
rejected as an overrides mismatch, so every branch failed to install. Pass
pnpm-version to Renovate as a constraint.
An Encore app cannot be tested with plain go build and go test. Add
go-prepare-command, which runs before the tests, and go-test-command, which
replaces the default Go build and test commands.
A repo with no packageManager field got the newest pnpm through Corepack.
Several repos pin pnpm in their own workflows instead. Add a pnpm-version
input to node-pr and renovate-autoupdate and activate it with corepack.
A repo can have more than one workflow that a push used to trigger, such
as a Docker build and a site deploy. Let release-workflow take a
comma-separated list and dispatch each one.
Renovate queries the repository issues when it starts. The job token had
no issues permission, so a private repo returned FORBIDDEN and Renovate
stopped with platform-unknown-error. Public repos expose issues, which hid
the problem. Grant issues: read to the Renovate job.
Add a reusable workflow that installs without changing the lockfile and
runs lint, typecheck, test and build, skipping scripts that do not exist.
It follows go-pr: a push to a branch with an open PR skips the duplicate
run, and stale runs are cancelled.
Renovate updated every go.mod and package.json in a repo, while the tests
cover one module and one Node project. An update outside them would merge
untested. Restrict the managers to the configured directories, and add go
and node switches for a repo that has no Go code or no frontend to test.
A Go major update changes the import path. Without rewriting imports the
PR only added the new module to go.mod, the tests passed, and Renovate
proposed it again. Rewrite the imports with gomodUpdateImportPaths so the
build tests the actual update, and cap indirect dependencies at their
current major, which the parent module decides.
The checkout used the triggering ref, so a run started from another
branch tested a stale tree and then hit conflicts. Check out the default
branch explicitly. When a passing PR conflicts, close it and skip, and
when the merge fails, close the PR and fail the job. Only a real test
failure goes to the issue.
Renovate skips a branch when a PR with the same title was closed, and
adds a comment to that PR. A PR closed after a merge or by hand must not
block the next update, so set recreateWhen to always.
A failing update has no PR, so its test output had nowhere to go. Capture
the output of the Go and Node steps. On failure, write it as a comment on
one sticky issue, one comment per branch, updated on every run. A final
job removes comments for branches that are gone and closes the issue when
no update fails. The step is best effort and also writes the run summary.
Renovate now prepares branches and opens no PR. Each branch is merged
into the default branch locally and tested, one at a time. Only a branch
that passes gets a PR, which merges at once, so a failing update never
shows up as a PR. Majors default to one branch each. The release is
dispatched once, after anything merged.
A repo with a backlog of majors got one PR per major on the first run.
Replace include-major with major-updates: ignore (default), separate or
batch. Ignore uses a version cap, because rules that disable by update
type have no effect.
The workflow runs inside the calling repository, so its own token is
enough and no PAT is needed. Drop the PAT fallbacks and make admin merge
opt-in, because the workflow token cannot bypass branch protection.
A merge made with that token does not trigger push workflows, so add a
release-workflow input that dispatches the release after the merge.
Renovate batches every minor and patch update in one PR. The workflow
tests that branch with go build and go test for Go and with the
package.json scripts for npm, pnpm and yarn. It squash-merges the PR only
when every test passes. Major updates get their own PR and never merge by
themselves. A renovate.json in the calling repo adds project rules.
The continue command that merges split builds stops after 30 minutes by
default. A slow multi-architecture docker build under QEMU hit that
limit and the superclaw release failed with context canceled after
30 minutes.
The goreleaser action takes a timeout input, default 60m, and passes it
to release, release --split and continue --merge. The release workflows
expose it as release-timeout.
The unpinned latest binfmt image can crash arm64 apt installs with a segmentation fault.
Pin the image to a known stable release for reproducible multi-arch builds.
The coverage step matched every line that contains the word total, so a
function name such as subtotal added a second value. GitHub then
rejected the multi-line step output. The step now reads the line that
starts with total:.
go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.
The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.
A run cancelled by a newer push still ran the report job. The gate then
failed and marked the superseded run as failed. The report job now
skips when the run is cancelled.
The && operator bound to the first operand only, so the label branch
returned the bare label before the format call. Parentheses keep the
whole fallback chain on the && branch.
A caller can grant narrower permissions than the release job needs. The
release then fails at the end, when it creates the tag or pushes an
image.
The preflight job now declares the same contents and packages
permissions as the release job and probes with the real token. A git
push dry run checks that the token can create the tag and release. A
ghcr.io token request and a blob upload session check that the token can
push the image. The upload session creates no package.
The release-cgo workflow probes ghcr only when the GoReleaser config
builds ghcr.io images. The release workflow probes it when
docker-enabled is true and the registry is ghcr.io. A probe that cannot
reach a verdict warns and does not fail.
A release run used to fail at the GoReleaser step when a secret was
empty, after the tests and the version job had finished.
A new preflight action checks the required names, the .Env references
in the GoReleaser config and push access to optional repositories. It
lists every problem in one run. The release and release-cgo workflows
run it in a first job, so a missing secret fails in seconds.
The release-cgo workflow requires GORELEASER_PRO. The release workflow
requires the secrets that the GoReleaser config references. Set the
preflight input to false to skip the check. Set preflight-repos to check
access to a Homebrew tap or helm-charts repository.
The workflow takes the same runner input as the release workflows.
Findings from go vet and staticcheck now appear as inline annotations
on the pull request diff. A new report job posts one comment with the
result of every check and the coverage. It fails when a check fails or
coverage is below the threshold. It no longer needs the bc command.
A push to a branch with an open pull request now skips its run, because
the pull_request event already runs the checks. Stale runs on the same
branch are cancelled. Every job has a timeout.
The release, release-cgo and autoupdate workflows must run on a runner
the caller chooses. Each workflow now takes a runner input. It accepts
a label or a JSON object that selects a runner group.
The workflow uses inputs.runner first. It then uses the
SHARED_ACTIONS_RUNNER variable and falls back to ubuntu-latest. Callers
that set nothing keep the old behaviour.
Every job now has a timeout. Release and autoupdate runs use a
concurrency group that never cancels a running job.
create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN,
so any consumer repo without that secret got 'Input token not supplied' and the
whole Autoupdate run failed. A same-repo PR needs only the caller's
contents/pull-requests write; fall back to the auto-provisioned github.token.
Consumers that do set the tap token keep current behavior.
lukaszraczyloandGitHub