ci: two-stage release with manual approval (2.x)#815
Conversation
Replace the previous shared node-release reusable workflow with the same prepare + approve + release flow used on master: a manually dispatched Prepare Release opens a version-bump PR, and merging it triggers a Release that checks the version against npm, pushes an approval request to DingTalk, waits on the `release` environment gate, then publishes (dist-tag `latest-2`) via OIDC and creates the GitHub Release.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Release urllib v2.44.1. Merging this PR updates the version on `2.x` and triggers the release workflow, which publishes to npm (dist-tag `latest-2`) and creates the GitHub Release after manual approval. ## What's Changed ### Security * Do not forward credential headers (`Authorization`, `Cookie`, `Proxy-Authorization`) on cross-origin redirect, and clear `auth`/`digestAuth` before following. Same-origin redirects are unchanged and the caller's headers object is never mutated (#813). ### Internal * Two-stage release workflow with manual approval, publishing the 2.x line to the `latest-2` npm dist-tag (#815). * Use Node 24 in the release workflow for npm 11 OIDC trusted publishing. --------- Co-authored-by: fengmk2 <156269+fengmk2@users.noreply.github.com> Co-authored-by: MK <fengmk2@gmail.com>
1 participant
Brings the 2.x maintenance branch onto the same release flow as master (#814), so every line releases the same way.
Flow: run Prepare Release (manual, with a version) -> it opens a
release/vX.Y.ZPR -> merge it -> Release checks the version against npm, pushes an approval request to DingTalk, waits on thereleaseenvironment gate, then publishes and creates the GitHub Release.2.x specifics:
latest-2(neverlatest).lib/directly (no build step).node-releasereusable workflow.id-token: write).Requires the repo
releaseenvironment (required reviewers) and npm trusted-publisher config to allow this branch's workflow. DingTalk secrets are already set repo-wide.