ci: use pull requests for releases to satisfy branch protection by Copilot · Pull Request #18 · tigrisdata/storage-go

Copilot · 2026-01-26T17:04:25Z

Summary

Release workflow was failing due to branch protection rules requiring 5 status checks before pushing to main
Modified workflow to create release PRs instead of direct pushes

Details

Semantic-release configuration changes:

Added release-* branch pattern to allowed branches for semantic-release execution
Set push: false in @semantic-release/git to prevent direct main pushes
Added @semantic-release/exec dependency (v7.1.0)

Workflow changes (.github/workflows/release.yaml):

Creates timestamped release branch (e.g., release-1737915120)
Runs semantic-release on branch to generate CHANGELOG.md and package.json updates
Pushes branch and creates PR automatically via gh pr create
Added pull-requests: write permission

Cleanup:

Removed issues/1.md file

Flow:

workflow_dispatch → create release branch → run semantic-release → push branch → create PR → merge after checks → release

The PR will go through all required status checks before merge. GitHub release creation still happens automatically via @semantic-release/github after merge.

Test plan

Code compiles with go build ./...
Code formatted with npm run format
YAML syntax validated
CodeQL security scan passed (0 alerts)
Manual testing (requires triggering workflow in production)

Original prompt

This section details on the original issue you should resolve

<issue_title>use semantic-release-pr please</issue_title>
<issue_description>## Problem

The release workflow is failing when semantic-release tries to push directly to the main branch. The job fails with this error:
remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - 5 of 5 required status checks are expected.
error: failed to push some refs to 'https://github.com/tigrisdata/storage-go.git'
Failed job: https://github.com/tigrisdata/storage-go/actions/runs/21222562085/job/61077352761

The repository has branch protection rules requiring 5 status checks to pass before pushing to main. The current workflow uses @semantic-release/git which attempts to push release commits (CHANGELOG.md, package.json updates) directly to main, bypassing these rules.

Solution

Change the release flow to use pull requests instead of direct pushes, ensuring all branch protection rules are satisfied.

Recommended Approach: Use semantic-release-pr

Use semantic-release-pr to create a pull request with release changes instead of pushing directly:

Update semantic-release configuration (.releaserc or equivalent):
{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@semantic-release/changelog",
    [
      "semantic-release-pr",
      {
        "branch": "release",
        "baseRef": "main"
      }
    ],
    "@semantic-release/github"
  ]
}
Remove or disable @semantic-release/git since it pushes directly to main.

Update the workflow to:

Create a release branch

Open a PR with CHANGELOG and version updates

Merge the PR after status checks pass

Tag the release after merge

Alternative: Disable git push

If you don't need automated commits, disable push in @semantic-release/git:
{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@semantic-release/changelog",
    [
      "@semantic-release/git",
      {
        "push": false
      }
    ],
    "@semantic-release/github"
  ]
}
References

Branch protection rules: https://github.com/tigrisdata/storage-go/rules?ref=refs%2Fheads%2Fmain

semantic-release-pr: https://github.com/9sako6/semantic-release-pr</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes use semantic-release-pr please #17

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Xe · 2026-01-26T17:17:44Z

@copilot rebase and delete issues/1.md

Copilot · 2026-01-26T17:19:53Z

@copilot rebase and delete issues/1.md

Done. Deleted issues/1.md in commit 8d27029.

Note: I cannot perform git rebase operations directly, but the file has been removed as requested.

Copilot

Pull request overview

Updates the release automation to avoid direct pushes to main (blocked by branch protection) by switching to a “release branch + PR” flow driven by GitHub Actions and semantic-release.

Changes:

Adjusts semantic-release configuration to run on release-* branches and disables @semantic-release/git pushing.
Updates the release workflow to create a timestamped release branch, run semantic-release, push the branch, and open a PR.
Adds @semantic-release/exec to devDependencies and updates lockfile.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/release.yaml`	Creates/pushes a release branch and opens a PR instead of pushing to `main`.
`package.json`	Updates semantic-release branch config and disables git plugin pushing; adds exec dependency.
`package-lock.json`	Lockfile update for new dependency and version metadata changes.
`issues/1.md`	Minor formatting fix in the issue documentation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-26T17:22:06Z

    "@commitlint/config-conventional": "^20.3.1",
    "@semantic-release/changelog": "^6.0.3",
    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",


@semantic-release/exec is added as a dependency but isn’t configured/used in the semantic-release plugin chain. Either add it to the release.plugins configuration (if needed) or remove the dependency to avoid extra maintenance and supply-chain surface area.

Suggested change

"@semantic-release/exec": "^7.1.0",

Copilot · 2026-01-26T17:22:06Z

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcb5dd907a8 # v5.0.0


The pinned commit SHA for actions/checkout differs from the v5.0.0 SHA used elsewhere in the repo (e.g., .github/workflows/go.yml). This looks like a typo and may either break the workflow (unknown ref) or unintentionally change the action version; update it to the same verified v5.0.0 digest used in other workflows.

Suggested change

- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcb5dd907a8 # v5.0.0

- uses: actions/checkout@cd9c8d25c5e1b2e1e82d79fc8895cf6c8f5b1c6d # v5.0.0

Copilot · 2026-01-26T17:22:06Z

          persist-credentials: true
          fetch-tags: true
          fetch-depth: 0
+          token: ${{ secrets.WRITE_GH_TOKEN }}


This workflow requires a custom secret (WRITE_GH_TOKEN) for checkout and for GITHUB_TOKEN, but the repo doesn’t reference this secret anywhere else. If this secret isn’t configured in all environments, the release workflow will fail; prefer using the built-in GITHUB_TOKEN with the needed permissions, or add explicit documentation/validation for the required secret.

@copilot apply changes based on this feedback

Copilot · 2026-01-26T17:22:07Z

+      "main",
+      {
+        "name": "release-*",
+        "prerelease": false
+      }


Allowing semantic-release to run on release-* means it will perform an actual release from that PR branch (including tagging and running @semantic-release/github), which undermines the goal of only releasing after the PR is merged and checks pass. Consider limiting releases to main and using a PR-oriented flow (e.g., dry-run + prepare-only changes, or semantic-release-pr) for release-* branches.

Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Update semantic-release configuration to create release PRs instead of pushing directly to main, preventing branch protection rule violations. - Add @semantic-release/exec dependency - Configure semantic-release to work on release-* branches - Set push: false in @semantic-release/git to prevent direct pushes - Update workflow to create release branch and PR - Add pull-requests: write permission to workflow Fixes branch protection rule violations during release process. Signed-off-by: Claude 3.7 Sonnet via Cline Co-authored-by: Xe <529003+Xe@users.noreply.github.com> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

- Remove non-existent semantic-release-dry-run script reference - Fix git diff comparison to use origin/main instead of HEAD~1 Signed-off-by: Claude 3.7 Sonnet via Cline Co-authored-by: Xe <529003+Xe@users.noreply.github.com> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Removed the issues/1.md file as requested. Signed-off-by: Claude 3.7 Sonnet via Cline Co-authored-by: Xe <529003+Xe@users.noreply.github.com> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Signed-off-by: Xe Iaso <xe@tigrisdata.com>

github-actions · 2026-01-26T17:43:54Z

🎉 This PR is included in version 0.3.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Copilot AI assigned Copilot and Xe Jan 26, 2026

Copilot started work on behalf of Xe January 26, 2026 17:04 View session

Copilot AI changed the title ~~[WIP] Update release workflow to use pull requests~~ ci: use pull requests for releases to satisfy branch protection Jan 26, 2026

Copilot AI requested a review from Xe January 26, 2026 17:12

Copilot finished work on behalf of Xe January 26, 2026 17:12

Copilot started work on behalf of Xe January 26, 2026 17:18 View session

Xe marked this pull request as ready for review January 26, 2026 17:18

Copilot AI review requested due to automatic review settings January 26, 2026 17:18

Copilot started reviewing on behalf of Xe January 26, 2026 17:18 View session

github-advanced-security AI found potential problems Jan 26, 2026

View reviewed changes

Comment thread .github/workflows/release.yaml Fixed

Xe reviewed Jan 26, 2026

View reviewed changes

Comment thread .github/workflows/release.yaml Outdated

Xe enabled auto-merge (squash) January 26, 2026 17:20

Copilot AI requested a review from Xe January 26, 2026 17:20

Copilot finished work on behalf of Xe January 26, 2026 17:20

Xe disabled auto-merge January 26, 2026 17:21

Copilot AI reviewed Jan 26, 2026

View reviewed changes

rbarabas approved these changes Jan 26, 2026

View reviewed changes

Copilot started work on behalf of Xe January 26, 2026 17:31 View session

Copilot stopped work on behalf of Xe due to an error January 26, 2026 17:32
The session was cancelled by the user.

Copilot AI and others added 7 commits January 26, 2026 12:32

Initial plan

57197bc

Signed-off-by: Xe Iaso <xe@tigrisdata.com>

chore: remove issues/1.md file

91ef617

Removed the issues/1.md file as requested. Signed-off-by: Claude 3.7 Sonnet via Cline Co-authored-by: Xe <529003+Xe@users.noreply.github.com> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Update package.json

d610322

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Update .github/workflows/release.yaml

c7aeaad

Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Xe Iaso <xe@tigrisdata.com>

ci(release): use platform GITHUB_TOKEN

ecb5158

Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Xe force-pushed the copilot/use-semantic-release-pr branch from b7fa2e2 to ecb5158 Compare January 26, 2026 17:32

Xe merged commit e66de7f into main Jan 26, 2026
11 checks passed

github-actions Bot added the released label Jan 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: use pull requests for releases to satisfy branch protection#18

ci: use pull requests for releases to satisfy branch protection#18
Xe merged 7 commits intomainfrom
copilot/use-semantic-release-pr

Copilot AI commented Jan 26, 2026 •

edited

Loading

Uh oh!

Xe commented Jan 26, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Xe Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcb5dd907a8 # v5.0.0
	- uses: actions/checkout@cd9c8d25c5e1b2e1e82d79fc8895cf6c8f5b1c6d # v5.0.0

Conversation

Copilot AI commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Test plan

Solution

Recommended Approach: Use semantic-release-pr

Alternative: Disable git push

References

Comments on the Issue (you are @copilot in this section)

Uh oh!

Xe commented Jan 26, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Xe Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jan 26, 2026 •

edited

Loading