Skip to content

ci(release): use dedicated runners for release publishing #2268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aidandaly24 merged 1 commit into from
Sep 10, 2026
+10 −10
Merged

ci(release): use dedicated runners for release publishing #2268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,18 +46,18 @@ compose freely.
Dispatch `release-prepare` with a bump and a channel, review the release PR it opens, merge it.
`release-publish` then publishes the merged package.json version.

Publishing listens for pushes to `refactor` (switch to `main` when the refactor lands), not PR
events. It looks up the pushed commit's associated PRs and proceeds only when that exact commit
Publishing listens for pushes to `refactor`, not PR events. It looks up the pushed commit's
associated PRs and proceeds only when that exact commit
is the merge of a `release/v*` PR opened by `agentcore-devx-automation[bot]` (account ID
`282717993`) from this repository into the target branch. Manually opened release PRs,
ordinary merges, fork PRs, and pushes without a matching release PR skip verification and
publishing. Every job uses the pushed SHA, so later commits cannot change what is released.

The prepare job uses `aws-release-4-core`. The check-release and publish jobs stay on
`ubuntu-latest` until `release-publish.yml` is allowlisted for the dedicated runner group.
The allowlist is scoped to workflow paths and branches; renaming a workflow or changing its
branch requires a runner-group administrator to update it. Keep PR-triggered workflows
and the verification matrix off this release-only pool.
The prepare, check-release, and publish jobs use `aws-release-4-core`. The `release-publish.yml`
allowlist currently covers `refactor` only. After the workflow lands on `main`, have a
runner-group administrator add its `main` entry before switching the publish branch filter.
The allowlist is scoped to workflow paths and branches; renaming a workflow also requires an
update. Keep PR-triggered workflows and the verification matrix off this release-only pool.

The npm package includes `dist` except `dist/bin`, plus standard package metadata. This keeps
additional bundle chunks and runtime assets included as the build evolves. Native binaries in
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
name: release-publish
on:
push:
# TODO: switch to main once the refactor lands there.
# TODO: switch to main once the refactor lands and this workflow is allowlisted there.
branches: [refactor]

jobs:
check-release:
if: "!github.event.deleted"
runs-on: ubuntu-latest
runs-on: aws-release-4-core
permissions:
pull-requests: read
outputs:
Expand Down Expand Up @@ -47,7 +47,7 @@ jobs:
publish:
needs: verify
# npm provenance is only issued from GitHub-hosted runners.
runs-on: ubuntu-latest
runs-on: aws-release-4-core
permissions:
contents: write
id-token: write
Expand Down
Loading