coder

15,221 Commits 479 Branches 388 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
Garrett Delfosse	b1ead5f085	fix: set git identity for release tagging and surface git stderr (#26945 ) ## What happened The [Tag and Release run](https://github.com/coder/coder/actions/runs/28549109434/job/84641825784) failed in the `prepare-release` job at the step "Prepare release (calculate version, create tag and branch)" with: ``` error: create tag v2.35.0-rc.0: exit status 128 ``` ## Root cause `prepare-release` creates an annotated tag via `git tag -a` (`scripts/release-action/prepare.go`), which records a tagger and therefore requires a git identity. The job never ran `git config user.name/user.email`, and runners have none configured, so git aborts with exit status 128. The real `fatal:` message was hidden because `realExecutor.RunMutation` discarded the command's stderr. ## Changes - `.github/workflows/tag-and-release.yaml`: add a "Configure git identity" step (`ci@coder.com` / `Coder CI`) to the `prepare-release` job, before the release tool runs. This matches the identity pattern already used later in the same workflow. - `scripts/release-action/cmdexec.go`: capture stderr in `RunMutation` and include it in the returned error, so a failing mutation surfaces the underlying command output (e.g. git's `fatal:` line) instead of only `exit status N`. - `scripts/release-action/cmdexec_test.go`: add a test asserting stderr is surfaced on failure. ## Testing - `go test ./scripts/release-action/...` passes. - `go vet ./scripts/release-action/...` and `gofmt` clean. - `actionlint .github/workflows/tag-and-release.yaml` clean. - Reproduced the failure locally: `git tag -a` with no usable identity exits 128 (`fatal: no email was given and auto-detection is disabled`); with an identity configured it succeeds. <details> <summary>Root-cause analysis / decision log</summary> Failing step runs `go run ./scripts/release-action prepare-release --type create-release-branch --ref main --commit cb1a87b…`. 1. The tool computes the next version `v2.35.0-rc.0` and calls `createAndPushTag`, which runs `git tag -a v2.35.0-rc.0 -m "Release v2.35.0-rc.0" <targetRef>` (`prepare.go:56`). 2. That git command exits 128, wrapped as `error: create tag v2.35.0-rc.0: exit status 128`. Why it's the identity, and not something else: - No `git config user.name/user.email` step exists in the `prepare-release` job; the `setup-mise` action does not set it; and the tool itself never sets an identity. Annotated tags require a tagger, so `git tag -a` fails on runners whose auto-detected identity is bogus (`…@runner.(none)`), which is rejected under git's strict identity check. - Not a pre-existing tag collision: no `v2.35.0*` tag exists on the remote, and the code pre-checks for an existing tag (and would emit a different "already exists" error). - Not an unresolved ref: `targetRef` resolves to the provided commit SHA, checked out at `fetch-depth: 0`. - The log was unhelpful because `RunMutation` used `cmd.Run()` without wiring git's stderr (`cmdexec.go`), discarding the `fatal:` line and leaving only `exit status 128`. This PR fixes that too. - The sibling `release.yaml` explicitly sets `git config user.email/user.name` before its git mutations; that step was simply missing from the newer `tag-and-release.yaml` `prepare-release` job. </details> --- > Generated by Coder Agents on behalf of @f0ssel.	2026-07-01 15:10:45 -07:00
Garrett Delfosse	ff7e0bc193	feat: add dry-run flag via CommandExecutor interface (#26422 ) ## Summary Adds a `--dry-run` capability to the `release-action` Go tool and exposes it through a new manual workflow, `tag-and-release.yaml`, without disturbing the existing `release.yaml` pipeline. PR #25162 had rewritten `release.yaml` in place to be driven by `scripts/release-action`, which changed its `workflow_dispatch` inputs from `release_channel`/`release_notes`/`dry_run` to `release_type`/`commit_sha`. That broke `scripts/releaser`, which dispatches `release.yaml` with the original inputs. This PR restores `release.yaml` and moves the Go-driven pipeline to its own workflow. ## Workflow layout after this PR \| Workflow \| Trigger \| Driven by \| Purpose \| \|---\|---\|---\|---\| \| `release.yaml` \| `scripts/releaser` (`gh workflow run`) \| legacy inline shell \| Existing pipeline, restored to pre-#25162 state \| \| `tag-and-release.yaml` \| Manual (Actions UI) \| `scripts/release-action` Go tool \| New pipeline with `prepare-release` + `dry_run` \| `release.yaml` is restored byte-for-byte to its pre-#25162 version, so its inputs match what `scripts/releaser` sends again. ## `release-action` design ### CommandExecutor interface Abstracts CLI command execution behind read-only and mutating methods: \| Method \| Purpose \| Dry-run behavior \| \|---\|---\|---\| \| `RunOutput` \| Read-only, capture stdout \| Executes normally \| \| `Run` \| Read-only, exit code only \| Executes normally \| \| `RunMutation` \| Changes remote state, no output \| Prints command, skips execution \| \| `RunMutationStdout` \| Changes remote state, streaming I/O \| Prints command, skips execution \| Two implementations: `realExecutor` (executes via `os/exec`) and `dryRunExecutor` (delegates read-only calls, prints mutating calls). ### `prepare-release` subcommand Composes `calculateNextVersion` with idempotent tag and branch creation+push, emitting the same JSON as `calculate-version`. Matching existing refs are skipped; mismatched refs error. ### `tag-and-release.yaml` `dry_run` input When enabled: `prepare-release` runs with `--dry-run` (version calculated, plan printed, nothing pushed), notes are generated for inspection, and the build+publish job is skipped via an `if` guard (cascading to homebrew/winget/docs). ## Mutating commands covered by `--dry-run` \| Command \| Call site \| \|---\|---\| \| `git tag -a <version> ...` \| `createAndPushTag` \| \| `git push origin refs/tags/...` \| `createAndPushTag` \| \| `git push origin <sha>:refs/heads/...` \| `createAndPushBranch` \| \| `gh release create ...` \| `publishRelease` \| `git fetch --tags --force origin` is intentionally not a mutation; it only updates local remote-tracking refs and must run for accurate version calculation. ## Changes - New: `scripts/release-action/cmdexec.go`, `prepare.go` (+ tests) - Refactored: `git.go`, `github.go`, `calculate.go`, `notes.go`, `commit.go`, `publish.go` to thread `CommandExecutor`; added `gitMutate` - Updated: `main.go` adds `--dry-run` flag and `prepare-release` subcommand - New: `.github/workflows/tag-and-release.yaml` (manual, Go-driven, with `dry_run`) - Reverted: `.github/workflows/release.yaml` to its pre-#25162 state > [!NOTE] > Generated by Coder Agents on behalf of @f0ssel	2026-07-01 16:20:00 -04:00

Author

SHA1

Message

Date

Garrett Delfosse

b1ead5f085

fix: set git identity for release tagging and surface git stderr (#26945 )

## What happened

The [Tag and Release
run](https://github.com/coder/coder/actions/runs/28549109434/job/84641825784)
failed in the `prepare-release` job at the step "Prepare release
(calculate version, create tag and branch)" with:

```
error: create tag v2.35.0-rc.0: exit status 128
```

## Root cause

`prepare-release` creates an **annotated** tag via `git tag -a`
(`scripts/release-action/prepare.go`), which records a tagger and
therefore requires a git identity. The job never ran `git config
user.name/user.email`, and runners have none configured, so git aborts
with exit status 128. The real `fatal:` message was hidden because
`realExecutor.RunMutation` discarded the command's stderr.

## Changes

- **`.github/workflows/tag-and-release.yaml`**: add a "Configure git
identity" step (`ci@coder.com` / `Coder CI`) to the `prepare-release`
job, before the release tool runs. This matches the identity pattern
already used later in the same workflow.
- **`scripts/release-action/cmdexec.go`**: capture stderr in
`RunMutation` and include it in the returned error, so a failing
mutation surfaces the underlying command output (e.g. git's `fatal:`
line) instead of only `exit status N`.
- **`scripts/release-action/cmdexec_test.go`**: add a test asserting
stderr is surfaced on failure.

## Testing

- `go test ./scripts/release-action/...` passes.
- `go vet ./scripts/release-action/...` and `gofmt` clean.
- `actionlint .github/workflows/tag-and-release.yaml` clean.
- Reproduced the failure locally: `git tag -a` with no usable identity
exits 128 (`fatal: no email was given and auto-detection is disabled`);
with an identity configured it succeeds.

<details>
<summary>Root-cause analysis / decision log</summary>

**Failing step** runs `go run ./scripts/release-action prepare-release
--type create-release-branch --ref main --commit cb1a87b…`.

1. The tool computes the next version `v2.35.0-rc.0` and calls
`createAndPushTag`, which runs `git tag -a v2.35.0-rc.0 -m "Release
v2.35.0-rc.0" <targetRef>` (`prepare.go:56`).
2. That git command exits **128**, wrapped as `error: create tag
v2.35.0-rc.0: exit status 128`.

**Why it's the identity, and not something else:**

- No `git config user.name/user.email` step exists in the
`prepare-release` job; the `setup-mise` action does not set it; and the
tool itself never sets an identity. Annotated tags require a tagger, so
`git tag -a` fails on runners whose auto-detected identity is bogus
(`…@runner.(none)`), which is rejected under git's strict identity
check.
- Not a pre-existing tag collision: no `v2.35.0*` tag exists on the
remote, and the code pre-checks for an existing tag (and would emit a
different "already exists" error).
- Not an unresolved ref: `targetRef` resolves to the provided commit
SHA, checked out at `fetch-depth: 0`.
- The log was unhelpful because `RunMutation` used `cmd.Run()` without
wiring git's stderr (`cmdexec.go`), discarding the `fatal:` line and
leaving only `exit status 128`. This PR fixes that too.
- The sibling `release.yaml` explicitly sets `git config
user.email/user.name` before its git mutations; that step was simply
missing from the newer `tag-and-release.yaml` `prepare-release` job.

</details>

---

> Generated by Coder Agents on behalf of @f0ssel.

2026-07-01 15:10:45 -07:00

Garrett Delfosse

ff7e0bc193

feat: add dry-run flag via CommandExecutor interface (#26422 )

## Summary

Adds a `--dry-run` capability to the `release-action` Go tool and
exposes it through a **new** manual workflow, `tag-and-release.yaml`,
without disturbing the existing `release.yaml` pipeline.

PR #25162 had rewritten `release.yaml` in place to be driven by
`scripts/release-action`, which changed its `workflow_dispatch` inputs
from `release_channel`/`release_notes`/`dry_run` to
`release_type`/`commit_sha`. That broke `scripts/releaser`, which
dispatches `release.yaml` with the original inputs. This PR restores
`release.yaml` and moves the Go-driven pipeline to its own workflow.

## Workflow layout after this PR

| Workflow | Trigger | Driven by | Purpose |
|---|---|---|---|
| `release.yaml` | `scripts/releaser` (`gh workflow run`) | legacy
inline shell | Existing pipeline, restored to pre-#25162 state |
| `tag-and-release.yaml` | Manual (Actions UI) |
`scripts/release-action` Go tool | New pipeline with `prepare-release` +
`dry_run` |

`release.yaml` is restored byte-for-byte to its pre-#25162 version, so
its inputs match what `scripts/releaser` sends again.

## `release-action` design

### CommandExecutor interface

Abstracts CLI command execution behind read-only and mutating methods:

| Method | Purpose | Dry-run behavior |
|---|---|---|
| `RunOutput` | Read-only, capture stdout | Executes normally |
| `Run` | Read-only, exit code only | Executes normally |
| `RunMutation` | Changes remote state, no output | **Prints command,
skips execution** |
| `RunMutationStdout` | Changes remote state, streaming I/O | **Prints
command, skips execution** |

Two implementations: `realExecutor` (executes via `os/exec`) and
`dryRunExecutor` (delegates read-only calls, prints mutating calls).

### `prepare-release` subcommand

Composes `calculateNextVersion` with idempotent tag and branch
creation+push, emitting the same JSON as `calculate-version`. Matching
existing refs are skipped; mismatched refs error.

### `tag-and-release.yaml` `dry_run` input

When enabled: `prepare-release` runs with `--dry-run` (version
calculated, plan printed, nothing pushed), notes are generated for
inspection, and the build+publish job is skipped via an `if` guard
(cascading to homebrew/winget/docs).

## Mutating commands covered by `--dry-run`

| Command | Call site |
|---|---|
| `git tag -a <version> ...` | `createAndPushTag` |
| `git push origin refs/tags/...` | `createAndPushTag` |
| `git push origin <sha>:refs/heads/...` | `createAndPushBranch` |
| `gh release create ...` | `publishRelease` |

`git fetch --tags --force origin` is intentionally not a mutation; it
only updates local remote-tracking refs and must run for accurate
version calculation.

## Changes

- **New**: `scripts/release-action/cmdexec.go`, `prepare.go` (+ tests)
- **Refactored**: `git.go`, `github.go`, `calculate.go`, `notes.go`,
`commit.go`, `publish.go` to thread `CommandExecutor`; added `gitMutate`
- **Updated**: `main.go` adds `--dry-run` flag and `prepare-release`
subcommand
- **New**: `.github/workflows/tag-and-release.yaml` (manual, Go-driven,
with `dry_run`)
- **Reverted**: `.github/workflows/release.yaml` to its pre-#25162 state

> [!NOTE]
> Generated by Coder Agents on behalf of @f0ssel

2026-07-01 16:20:00 -04:00