Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
169 changes: 0 additions & 169 deletions .github/workflows/manual-release.yaml

This file was deleted.

112 changes: 112 additions & 0 deletions .github/workflows/release.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,112 @@
name: Release

on:
workflow_dispatch:
inputs:
bump:
description: "Version bump type"
required: true
default: "patch"
type: choice
options:
- patch
- minor
- major

concurrency:
group: release
cancel-in-progress: false

permissions:
id-token: write
Copy link
Copy Markdown

@augmentcode augmentcode Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.github/workflows/release.yaml:21 id-token: write enables OIDC token minting, but this workflow doesn’t appear to use any OIDC-based auth. Keeping it increases the available token surface area unnecessarily.

Severity: low

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

contents: write

jobs:
release:
if: github.repository == 'bmad-code-org/bmad-module-game-dev-studio' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.RELEASE_APP_ID }}
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ steps.app-token.outputs.token }}

- name: Setup Node
uses: actions/setup-node@v4
with:
node-version-file: ".nvmrc"
cache: "npm"

- name: Configure git user
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"

- name: Install dependencies
run: npm ci

- name: Run validation
run: npm test

- name: Bump version
run: |
npm version ${{ inputs.bump }} -m "chore(release): v%s [skip ci]"

- name: Capture new version
id: version
run: |
VERSION=$(node -p "require('./package.json').version")
echo "version=${VERSION}" >> $GITHUB_OUTPUT
echo "tag=v${VERSION}" >> $GITHUB_OUTPUT

- name: Push version commit and tag
run: git push origin main --follow-tags

- name: Create GitHub Release
run: |
TAG="${{ steps.version.outputs.tag }}"
VERSION="${{ steps.version.outputs.version }}"
BODY=$(awk -v ver="$VERSION" '
/^## v/ { if (found) exit; if (index($0, "## v" ver)) found=1; next }
Copy link
Copy Markdown

@augmentcode augmentcode Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.github/workflows/release.yaml:78 The index($0, "## v" ver) match can also match headings like ## v1.2.3-rc.1 when releasing 1.2.3, which could extract the wrong CHANGELOG section. This would make the GitHub Release notes incorrect even though a correct ## v1.2.3 - ... section exists.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

found { print }
' CHANGELOG.md)
if [ -z "$BODY" ]; then
echo "::error::No CHANGELOG.md entry found for $TAG. Add a '## v${VERSION} - DATE' section before releasing."
exit 1
fi
gh release create "$TAG" \
--title "Game Dev Studio $TAG" \
--notes "$BODY"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Copy link
Copy Markdown

@augmentcode augmentcode Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.github/workflows/release.yaml:89 gh release create authenticates with secrets.GITHUB_TOKEN; if the repo/org config makes that token read-only, this step will fail even though a GitHub App token was already generated earlier. That mismatch can make releases flaky depending on repository settings.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.


- name: Notify Discord
if: success()
continue-on-error: true
run: |
set -o pipefail
source .github/scripts/discord-helpers.sh
[ -z "$WEBHOOK" ] && exit 0
TAG="${{ steps.version.outputs.tag }}"
RELEASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/${TAG}"
MSG=$(printf '🎮 **[Game Dev Studio %s released](<%s>)**' "$TAG" "$RELEASE_URL" | esc)
jq -n --arg content "$MSG" '{content: $content}' | curl -sf --retry 2 -X POST "$WEBHOOK" -H "Content-Type: application/json" -d @-
env:
WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

- name: Summary
run: |
TAG="${{ steps.version.outputs.tag }}"
{
echo "## Released ${TAG}"
echo ""
echo "- **GitHub Release:** https://github.com/${{ github.repository }}/releases/tag/${TAG}"
} >> $GITHUB_STEP_SUMMARY
Loading