Merge pull request #1981 from kili-technology/chore/smooth-release

chore: use a dedicated user to push tag

Author: baptiste-olivier

.github/workflows/pre_release.yml

@@ -1,23 +1,30 @@
 name: Pre-release - Bump version & draft release
+
 on:
   workflow_dispatch:
     inputs:
       target_branch:
         description: >
           "This workflow will create a commit to bump version on a branch.
-          Enter the target branch: main for Saas, or release/XX.Y for a LTS version: "
+          Enter the target branch: main for SaaS, or release/XX.Y for an LTS version: "
         required: true
         type: string
         default: "main"
 
+permissions:
+  contents: write
+
 jobs:
   pre_release:
     runs-on: ubuntu-latest
     name: Bump version & draft release
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout target branch
+        uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.target_branch}}
+          ref: ${{ github.event.inputs.target_branch }}
+          token: ${{ secrets.RELEASE_BOT_PAT }}   # <<< service PAT
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -32,49 +39,63 @@ jobs:
 
       - name: Set git identity
         run: |
-          git config user.name github-actions
-          git config user.email github-actions@github.com
+          git config user.name "kili-release-bot"
+          git config user.email "[email protected].github.com"
 
       - name: Add the bump commit
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_BOT_PAT }}
+        shell: bash
         run: |
+          set -euo pipefail
+
           git fetch --quiet
 
           curl https://raw.githubusercontent.com/kili-technology/kili-python-sdk/main/.github/scripts/utils.sh --output utils.sh
-          source ./utils.sh   # to get the bump_version function
+          source ./utils.sh   # exposes bump_version
 
-          # create bump commit
+          # create bump commit (major / minor / patch)
           new_version=$(bump_version commit patch)
           echo "New version (bump_version): $new_version"
 
-          git push
-        env:
-          GH_TOKEN: ${{ github.token }} # needed for gh cli
+          # Push back to the same branch explicitly
+          git push origin HEAD:${{ github.event.inputs.target_branch }}
 
-      - name: create draft release
+      - name: Create tag and draft release
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_BOT_PAT }}   # used by gh CLI
+        shell: bash
         run: |
+          set -euo pipefail
+
           curl https://raw.githubusercontent.com/kili-technology/kili-python-sdk/main/.github/scripts/utils.sh --output utils.sh
-          source ./utils.sh   # to get the get_sdk_version_from_pyproject_toml function
+          source ./utils.sh
 
-          # Get release version
+          # Get release version from pyproject.toml (now bumped)
           release_version=$(get_sdk_version_from_pyproject_toml)
           echo "Release version: $release_version"
 
-          # tag and push the tag
-          # -a to create an annotated tag
-          git fetch --quiet
-          git tag -a $release_version -m "Release $release_version"
-          git push origin $release_version
+          # Get last release tag for release notes range
+          latest_release=$(get_last_release_tag_github)
+          echo "Latest release tag: $latest_release"
 
-          # create draft release
-          link_to_draft=$(gh release create $release_version --draft --title "Release $release_version" --generate-notes --notes-start-tag $latest_release)
-          echo "Link to draft release: $link_to_draft"
+          git fetch --tags --quiet
+
+          # Create annotated tag on this commit & push it
+          git tag -a "$release_version" -m "Release $release_version"
+          git push origin "$release_version"
 
-          # filter the result to get the link
-          # will match any string that starts with https:// and contains any number of characters that are not spaces.
+          # Create draft release
+          link_to_draft=$(gh release create "$release_version" \
+            --draft \
+            --title "Release $release_version" \
+            --generate-notes \
+            --notes-start-tag "$latest_release")
+
+          # Extract URL from gh output
           link_to_draft=$(echo "$link_to_draft" | grep -o 'https://[^ ]*')
+
           echo "Link to draft release: $link_to_draft"
 
-          echo "LINK_TO_DRAFT=$link_to_draft" >> $GITHUB_ENV
-          echo "RELEASE_VERSION=$release_version" >> $GITHUB_ENV
-        env:
-          GH_TOKEN: ${{ github.token }} # needed for gh cli
+          echo "LINK_TO_DRAFT=$link_to_draft" >> "$GITHUB_ENV"
+          echo "RELEASE_VERSION=$release_version" >> "$GITHUB_ENV"

.github/workflows/release.yml

@@ -10,9 +10,6 @@ jobs:
     permissions:
       # needed to publish to PyPI
       id-token: write
-      # needed to create a PR to merge the release branch and main
-      contents: write
-      pull-requests: write
     steps:
       - uses: actions/checkout@v4
 
@@ -82,25 +79,6 @@ jobs:
           git config user.name github-actions
           git config user.email [email protected]
 
-      - name: create PR to merge release branch and main
-        run: |
-          git fetch --quiet
-
-          # ${{ github.ref_name }}: The short ref name of the branch or tag that triggered the workflow run.
-          git checkout ${{ github.ref_name }}
-
-          curl https://raw.githubusercontent.com/kili-technology/kili-python-sdk/main/.github/scripts/utils.sh --output utils.sh
-          source ./utils.sh   # to get the bump_version function
-
-          sdk_version=$(get_sdk_version_from_pyproject_toml)
-
-          # create a branch to merge the release branch and main
-          git checkout -b merge_release/$sdk_version
-          git push --set-upstream origin merge_release/$sdk_version
-          gh pr create --title "chore: merge release/$sdk_version into main" --body "Merge release/$sdk_version into main" --base main
-        env:
-          GH_TOKEN: ${{ github.token }} # needed for gh cli
-
   deploy-documentation:
     uses: ./.github/workflows/deploy_doc.yml
     needs: [publish] # Run after the previous job