Skip to content

Automate release tagging via deploy key + self-pin bump - #638

Open
MaddyMicrosoft wants to merge 9 commits into
masterfrom
release-selfref-automation
Open

Automate release tagging via deploy key + self-pin bump#638
MaddyMicrosoft wants to merge 9 commits into
masterfrom
release-selfref-automation

Conversation

@MaddyMicrosoft

@MaddyMicrosoft MaddyMicrosoft commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Automates release tagging via a repo-scoped deploy key (the one identity allowed to bypass the tag rulesets), keeps our azure/login@<sha> self-references current after each release, and adds a rotation reminder.

Changes

  • release.yml — checkout uses ssh-key: RELEASE_DEPLOY_KEY, so the release-branch push, version-tag create, and v3 move go through the deploy key (needed to bypass the tag rulesets and to trigger downstream CI). New open-selfpin-pr job rewrites the azure/login@<sha> pins to the new release commit and opens a chore/* PR (uses GITHUB_TOKEN, not the key).
  • rollback.yml — same ssh-key addition for the v3 force-move.
  • dependabot.yml — ignores azure/login (now owned by the release workflow) to avoid duplicate bump PRs; third-party actions still covered.
  • deploy-key-rotation-reminder.yml (new) — opens an issue every 6 months (Jan/Jul) to rotate RELEASE_DEPLOY_KEY; idempotent, issues: write only.

Deploy key

Repo-scoped SSH key, git-only, no API access. Private key stored as an environment secret on release (admin-gated). Only elevated power: bypass tags-create-blocked + major-tags-move-blocked. Not granted bypass on minor/delete rulesets; never writes master or opens PRs.

Requires admin setup before functional

  1. Create deploy key + RELEASE_DEPLOY_KEY env secret on release.
  2. Add key as bypass actor on tags-create-blocked + major-tags-move-blocked.
  3. Enable "Allow Actions to create and approve PRs".
  4. (Related) Add releases/** write-once ruleset.

Testing

Deploy-key push/bypass validated end-to-end in the azclitools-actions-test sandbox (key push succeeds + triggers CI; GITHUB_TOKEN blocked), then cleaned up. YAML validated locally.

MaddyMicrosoft and others added 2 commits September 3, 2026 06:35
@MaddyMicrosoft
ci: authenticate release and rollback tag pushes via RELEASE_DEPLOY_KEY
eaa36ec 
Use the release deploy key (SSH) for git operations in release.yml and
rollback.yml so branch/tag pushes bypass the tag protection rulesets and
trigger the CI / live-test workflows, which GITHUB_TOKEN pushes do not.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
ci: open self-pin bump PR after release
e2253cf 
Add an open-selfpin-pr job that runs after a current-major release, rewrites
the azure/login@<sha> self-references in the workflow files to the new release
commit, pushes a chore/* branch, and opens a PR via GITHUB_TOKEN. Uses the
default token (not the deploy key) since chore/* branches are unprotected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft MaddyMicrosoft added the do not merge Not ready label Sep 4, 2026
MaddyMicrosoft and others added 5 commits September 4, 2026 05:41
@MaddyMicrosoft
ci: authenticate release and rollback tag pushes via RELEASE_DEPLOY_KEY
78c1063 
Use the release deploy key (SSH) for git operations in release.yml and
rollback.yml so branch/tag pushes bypass the tag protection rulesets and
trigger the CI / live-test workflows, which GITHUB_TOKEN pushes do not.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
ci: open self-pin bump PR after release
123f6aa 
Add an open-selfpin-pr job that runs after a current-major release, rewrites
the azure/login@<sha> self-references in the workflow files to the new release
commit, pushes a chore/* branch, and opens a PR via GITHUB_TOKEN. Uses the
default token (not the deploy key) since chore/* branches are unprotected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
ci: exclude azure/login from Dependabot (owned by release workflow)
c447668 
The release workflow's open-selfpin-pr job bumps the azure/login
self-reference pins on each release, so ignore azure/login in Dependabot
to avoid duplicate bump PRs. Third-party actions remain covered.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
Merge branch 'release-selfref-automation' of https://github.com/Azure…
ac60a58 
…/login into release-selfref-automation
@MaddyMicrosoft
ci: add scheduled deploy key rotation reminder
a374915 
Add a workflow that opens a GitHub issue on a routine 6-month cadence
(Jan/Jul) reminding maintainers to rotate RELEASE_DEPLOY_KEY. Idempotent:
skips if an open reminder issue already exists. Uses GITHUB_TOKEN
(issues: write) only; wording is neutral for the public repo.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
MaddyMicrosoft marked this pull request as ready for review September 6, 2026 23:55
@MaddyMicrosoft MaddyMicrosoft changed the title Release selfref automation Automate release tagging via deploy key + self-pin bump Sep 6, 2026
MaddyMicrosoft and others added 2 commits September 7, 2026 01:07
@MaddyMicrosoft
Pin release-notes start tag so generate-notes diffs the right previou…
a3a6218 
…s release

Without an explicit start tag, gh release create --generate-notes lets GitHub
auto-select the previous tag and it can pick the floating major tag (v3),
dumping the entire history into the notes (as happened for v3.0.2).

Compute the previous vX.Y.Z tag via sort -V and pass --notes-start-tag, with an
optional previous_version dispatch input as a manual override.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@MaddyMicrosoft
ci: guard release build output and roll back self-pins on rollback
d8e6013 
- release.yml: fail fast if the build did not produce lib/main/index.js and
  lib/cleanup/index.js, so a broken build can never be tagged as an
  (effectively immutable) release.
- rollback.yml: add an open-selfpin-pr job mirroring release.yml, so a
  rollback also opens a PR repointing the azure/login self-references to the
  rolled-back version. Guarded to only act when the rollback target major
  matches master's currently pinned major (a back-major rollback is skipped).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI reviewed Sep 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The release workflow has a broken conditional argument expansion for --notes-start-tag, and the self-pin sed rewrite would break workflow YAML indentation (plus the reminder issue body will render as a code block due to leading spaces).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the release/rollback automation to use a repo-scoped deploy key for tag/branch pushes (to bypass tag rulesets where allowed), adds logic to make GitHub release notes diff against the correct prior semver tag, and introduces automation to keep this repo’s workflow self-pins (azure/login@<sha>) updated after each release.

Changes:

  • Configure actions/checkout in release/rollback workflows to use ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }} for tag/branch operations.
  • Add previous_version input and compute a stable --notes-start-tag for gh release create.
  • Add a post-release job to open a PR that bumps workflow azure/login@<sha> pins, plus Dependabot ignore + a scheduled key-rotation reminder workflow.
File summaries
File Description
.github/workflows/release.yml Uses deploy key checkout for release pushes; adds previous_version handling; adds open-selfpin-pr automation job.
.github/workflows/rollback.yml Uses deploy key checkout to force-move the major tag during rollback.
.github/workflows/deploy-key-rotation-reminder.yml New scheduled workflow to open a periodic issue reminding admins to rotate the deploy key.
.github/dependabot.yml Ignores azure/login GitHub Action updates to avoid duplicate self-pin bump PRs.
Review details
  • Files reviewed: 4/4 changed files
  • Comments generated: 3
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/release.yml
Comment on lines +184 to +187
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -e "$f" ] || continue
sed -i -E "s|(uses:[[:space:]]+azure/login@)[^[:space:]]+.*|\1${SHA} # ${V}|" "$f"
done
Comment thread .github/workflows/release.yml
Comment on lines 159 to +162
gh release create "$V" \
--title "Azure Login Action $V" \
--generate-notes
--generate-notes \
${PREV:+--notes-start-tag "$PREV"}
Comment thread .github/workflows/deploy-key-rotation-reminder.yml
Comment on lines +27 to +35
gh issue create --repo "$REPO" --title "$TITLE" --body 'Routine scheduled reminder to rotate the release deploy key (`RELEASE_DEPLOY_KEY`, on the `release` environment). This is a standard 6-month rotation, not an indication of any incident.

Rotation steps (requires repo admin; add the new key before removing the old one so there is no release downtime):

1. Generate a new SSH keypair with an empty passphrase.
2. Add the new public key as a **write** deploy key.
3. Update the `RELEASE_DEPLOY_KEY` environment secret with the new private key.
4. Delete the previous deploy key.
5. Close this issue.'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@teresaritorto Teresa Ritorto (teresaritorto) teresaritorto approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

do not merge Not ready

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MaddyMicrosoft @teresaritorto