Skip to content

Commit 7a03614

Browse files
bmadcodebmadcode
authored
chore(release): rewrite release pipeline with App auth and cosign signing (#79)
* chore(release): rewrite release workflow with App auth and cosign signing Replaces manual-release.yaml with release.yaml modeled on bmad-method's publish.yaml. Uses BMAD Release Bot App token for pushes to protected main, runs full `npm test` validation stack, signs tag SHA with cosign keyless via GitHub OIDC, and extracts release body from CHANGELOG.md using keep-a-changelog bracket format. Drops two broken steps from the old workflow: `npm run validate` (script does not exist) and `sed tools/installer/package.json` (path does not exist). Adds v1.7.0 CHANGELOG entry. First release under the new pipeline. * fix(release): remove broken legacy test scripts and align release CI with PR CI Removes five package.json scripts that reference files removed in earlier refactors (test/, src/ paths that no longer exist in bmb): - test - test:refs (node test/test-validate-file-refs.cjs) - test:schemas (node test/test-agent-schema.js) - validate:refs (scans src/ which bmb does not use) - validate:schemas (node test/validate-agent-schema.js) None of these have worked for some time. The old manual-release.yaml called `npm run validate` which also did not exist. Real test coverage can be added later when there is something meaningful to assert. Realigns release workflow validation step to run the same checks quality.yaml runs on PRs: format:check and lint:md. If a PR is green, the release workflow has nothing stricter to fail on. Also fixes prettier YAML syntax error on the Bump version step by converting the inline run to block scalar form.
1 parent 7a48868 commit 7a03614

4 files changed

Lines changed: 140 additions & 175 deletions

File tree

‎.github/workflows/manual-release.yaml‎

Lines changed: 0 additions & 169 deletions
This file was deleted.

‎.github/workflows/release.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
bump:
7+
description: "Version bump type"
8+
required: true
9+
default: "patch"
10+
type: choice
11+
options:
12+
- patch
13+
- minor
14+
- major
15+
16+
concurrency:
17+
group: release
18+
cancel-in-progress: false
19+
20+
permissions:
21+
id-token: write
22+
contents: write
23+
24+
jobs:
25+
release:
26+
if: github.repository == 'bmad-code-org/bmad-builder' && github.ref == 'refs/heads/main'
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Generate GitHub App token
30+
id: app-token
31+
uses: actions/create-github-app-token@v2
32+
with:
33+
app-id: ${{ secrets.RELEASE_APP_ID }}
34+
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
35+
36+
- name: Checkout
37+
uses: actions/checkout@v4
38+
with:
39+
fetch-depth: 0
40+
token: ${{ steps.app-token.outputs.token }}
41+
42+
- name: Setup Node
43+
uses: actions/setup-node@v4
44+
with:
45+
node-version-file: ".nvmrc"
46+
cache: "npm"
47+
48+
- name: Configure git user
49+
run: |
50+
git config user.name "github-actions[bot]"
51+
git config user.email "github-actions[bot]@users.noreply.github.com"
52+
53+
- name: Install dependencies
54+
run: npm ci
55+
56+
- name: Run validation
57+
run: |
58+
npm run format:check
59+
npm run lint:md
60+
61+
- name: Bump version
62+
run: |
63+
npm version ${{ inputs.bump }} -m "chore(release): v%s [skip ci]"
64+
65+
- name: Capture new version
66+
id: version
67+
run: |
68+
VERSION=$(node -p "require('./package.json').version")
69+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
70+
echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
71+
72+
- name: Push version commit and tag
73+
run: git push origin main --follow-tags
74+
75+
- name: Install cosign
76+
uses: sigstore/cosign-installer@v3
77+
78+
- name: Sign tag SHA with cosign (keyless)
79+
run: |
80+
TAG="${{ steps.version.outputs.tag }}"
81+
SHA=$(git rev-parse "${TAG}")
82+
printf '%s' "${SHA}" > "${TAG}.sha"
83+
cosign sign-blob --yes \
84+
--output-signature "${TAG}.sig" \
85+
--output-certificate "${TAG}.pem" \
86+
"${TAG}.sha"
87+
88+
- name: Create GitHub Release
89+
run: |
90+
TAG="${{ steps.version.outputs.tag }}"
91+
VERSION="${{ steps.version.outputs.version }}"
92+
BODY=$(awk -v ver="$VERSION" '
93+
/^## \[/ { if (found) exit; if (index($0, "## [" ver "]")) found=1; next }
94+
found { print }
95+
' CHANGELOG.md)
96+
if [ -z "$BODY" ]; then
97+
echo "::error::No CHANGELOG.md entry found for $TAG. Add a '## [${VERSION}] - YYYY-MM-DD' section before releasing."
98+
exit 1
99+
fi
100+
gh release create "$TAG" \
101+
--title "BMad Builder $TAG" \
102+
--notes "$BODY" \
103+
"${TAG}.sig" \
104+
"${TAG}.pem" \
105+
"${TAG}.sha"
106+
env:
107+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
108+
109+
- name: Notify Discord
110+
if: success()
111+
continue-on-error: true
112+
run: |
113+
set -o pipefail
114+
source .github/scripts/discord-helpers.sh
115+
[ -z "$WEBHOOK" ] && exit 0
116+
TAG="${{ steps.version.outputs.tag }}"
117+
RELEASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/${TAG}"
118+
MSG=$(printf '🛠️ **[BMad Builder %s released](<%s>)**' "$TAG" "$RELEASE_URL" | esc)
119+
jq -n --arg content "$MSG" '{content: $content}' | curl -sf --retry 2 -X POST "$WEBHOOK" -H "Content-Type: application/json" -d @-
120+
env:
121+
WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
122+
123+
- name: Summary
124+
run: |
125+
TAG="${{ steps.version.outputs.tag }}"
126+
SHA=$(git rev-parse "${TAG}")
127+
{
128+
echo "## Released ${TAG}"
129+
echo ""
130+
echo "- **GitHub Release:** https://github.com/${{ github.repository }}/releases/tag/${TAG}"
131+
echo "- **Tag SHA (cosign-signed):** \`${SHA}\`"
132+
echo "- **Signature artifacts:** \`${TAG}.sig\`, \`${TAG}.pem\`, \`${TAG}.sha\` attached to the release"
133+
} >> $GITHUB_STEP_SUMMARY

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog
22

3+
## [1.7.0] - 2026-04-23
4+
5+
### 📚 Documentation
6+
7+
* **Customization authoring flow awareness** — `explanation/customization-for-authors.md` and `how-to/make-a-skill-customizable.md` now mention `bmad-customize`, the conversational authoring helper that walks users through scope selection, override writing, and merge verification. Guides authors to pick field names and defaults that read well in that flow, while preserving that hand-writing TOML still works for users who prefer it (#78)
8+
39
## [1.6.0] - 2026-04-20
410

511
### 🎁 Features

‎package.json‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,7 @@
3030
"lint": "eslint . --ext .js,.cjs,.mjs,.yaml --max-warnings=0",
3131
"lint:fix": "eslint . --ext .js,.cjs,.mjs,.yaml --fix",
3232
"lint:md": "markdownlint-cli2 \"**/*.md\"",
33-
"prepare": "husky || exit 0",
34-
"test": "npm run test:schemas && npm run test:refs && npm run validate:schemas && npm run lint && npm run lint:md && npm run format:check",
35-
"test:refs": "node test/test-validate-file-refs.cjs",
36-
"test:schemas": "node test/test-agent-schema.js",
37-
"validate:refs": "node tools/validate-file-refs.mjs",
38-
"validate:schemas": "node test/validate-agent-schema.js"
33+
"prepare": "husky || exit 0"
3934
},
4035
"lint-staged": {
4136
"*.{js,cjs,mjs}": [

0 commit comments

Comments
 (0)