Repository navigation
ci: only Create Release waits for a deployment approval (#2648) - #2658
Merged
Merged
Conversation
- cron-python-versions.yml, cron-issue-pr-kinds.yml: `pr` names the `release-app` environment, which has no reviewer, not `github-release`. Its first step reads whether RELEASE_APP_PRIVATE_KEY is set and, if not, warns and skips the other steps instead of failing at minting. Comments no longer say the key waits on the owner's approval. - util/update_python_versions.py: its prose no longer speaks of an approval. - releasing.rst: the App setup stores the key in each environment, and why; the reviewer paragraph names `release-app`. - workflows.rst: the cron sections and Deployment `environment:` describe `release-app` and the key check. - tests/project: the cron pins expect `release-app`; the new test_release_app_environment_2648.py checks that only Create Release's `github` names `github-release` and every other key reader, in Create Release or elsewhere, `release-app`, with mutation rows, and runs the key check under bash. Tests: touched tests/project modules pass; the guard fails on main's cron jobs and each mutation.
JarryShaw
added
ci
Owner
Author
|
GOOD TO GO at |
JarryShaw
removed
the
review: good-to-go
1 of 5 tasks
JarryShaw
added a commit
that referenced
this pull request
Nov 2, 2026
…he cut-frame fixes and GRE's bindings into 1.6.0 (#2449) - Breaking: TCP, UDP and SCTP makers (#2670) and PCAP-NG's (#2671) raise on a value a field cannot hold, where 1.5.x wrote it masked; each entry gives the old and new values. The TTL Diff wraps as before. - Changed: __index__ returns the LinkType, EtherType, TransType or AppType value, ports as ints (#2652); only Create Release waits for a deployment approval (#2658). The conventions entry records the index rule. - Fixed: a cut HTTP/2 SETTINGS frame parses and rebuilds; HTTPv2.make takes frame_length (#2666). - Folded into unreleased entries: FRAD at LinkType 107 and GRE at IP protocol 47 (#2667); cut IGMPv3 messages and num_group_records (#2662, #2672); Linux_ARPHRD (#2663); DCCP's range checks (#2670); a cut GRE frame is TRUNCATED, replacing fold-12's INVALID note, and frame_length in pcapkit.utilities.contextvars (#2668). - No entry for _make_sint's private allow_unsigned, ARP's private PAT_MAC_ADDR, or the test- and docs-only d728873, 326a6cf, fc80fb1, a37edf1 and 2766707. - CHANGELOG.md regenerated; util/changelog_md.py --check passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
ci— workflows or build toolingDescription of your pull request and other information
The owner ruled in session that manual deployment approval is for Create Release only.
github-release, the one environment with a required reviewer, was also entered by theprjobs ofcron-issue-pr-kinds.ymlandcron-python-versions.yml, only to readRELEASE_APP_PRIVATE_KEY. So every one of those runs waited for approval.prjobs use therelease-appenvironment, which has no reviewer and allows deployments frommainonly. It holds its own copy of the key. Their App token keeps its narrow permissions.github-release, unchanged.test_release_app_environment_2648fails if any job other than Create Release'sgithubentersgithub-release, or if any other job reads the key outsiderelease-app.Owner action needed: add
RELEASE_APP_PRIVATE_KEYto therelease-appenvironment, with the same value as ingithub-release.A Sonnet cross-review returned GOOD TO GO after one fix round, which removed counts, widened the guard and fixed wording.
Closes #2648