CLOUD-733: Add Automated Releases by simonwgill · Pull Request #340 · citizensadvice/ca-cdk-constructs

simonwgill · 2026-08-21T11:24:36Z

Describe your changes

Created using Claude, and reviewed into shape locally.

This provides us a regular patch bump if prompted by changes to the projects dependency constraints. This is expected on a weekly basis as the aws-cdk-lib and kubectl layer should be getting weekly updates which bring updated versions of software that dependabot can't trace CVE data for.

If any change from the previous tag is found in the dependency section of pyproject.toml, 04_cron_release.yml will create a PR for the version bump (following the branch protection rules that should be enabled on this repository). When a PR which matches the version bump pattern is merged to main, a draft release will be created that can then be pushed out.

Because this requires multiple touches, there's a cooldown on creating new versions of 4 days. That should minimise doing versions too close together, but also prevent them spreading further and further apart by enforcing a minimum of 7 days between.

All tasks are performed using the Justfile to comply with the org standard.

Checklist before requesting a review

I have performed a self-review of my code
I have updated the Readme / docs
If this is a breaking change, I have discussed the roll-out and roll-back plan with the team(s) and I have provided detailed instructions
If it is a core feature, I have added thorough tests

Creates a check job that: - Finds the latest release tag - Calculates days since last release - Enforces 4-day cooldown between releases - Outputs whether a PR should be created This prevents creating releases too frequently while ensuring they're not delayed indefinitely.

Only create release PRs when: - Dependabot commits exist since last tag AND - 4-day cooldown has passed This ensures releases only happen when dependencies have been updated, not on every cron run.

Justfile commands: - get-version: Query current package version - ci-configure-git: Set git user for GitHub Actions - ci-create-release-branch: Create dated release branch Workflow adds second job that: - Only runs when check passes - Sets up environment (checkout, just, uv with Python 3.13) - Configures git with bot identity - Creates release branch with date suffix

Justfile: - ci-bump-and-commit: Bumps version, stages files, and commits Workflow: - Bumps patch version using uv - Creates commit with version in message - Captures new version for next steps Defaults to patch bumps for dependency updates.

Justfile: - ci-push-branch: Pushes specified branch to origin Workflow: - Pushes release branch with version bump commit - Uses branch name from earlier step

Justfile: - ci-create-pr: Creates PR with version and branch name Includes template body with next steps for reviewers Workflow: - Creates PR targeting main - Uses version and branch from previous steps - Provides GitHub token for authentication Completes the automated release PR workflow.

Workflow: - Triggers on PR merge to main - Checks commit message for version bump pattern - Extracts version from pyproject.toml via justfile - Creates draft release with auto-generated notes Justfile: - ci-create-draft-release: Creates draft GitHub release Works in tandem with automated release PR workflow to complete the release cycle with human review at PR merge and release publish.

… changes

michelesr · 2026-08-24T10:18:00Z

+
+# CI-only: Configure git for automated commits
+[group("release")]
+ci-configure-git:


I think this should fail with a warning if the username and ~~password~~ email are already configured: otherwise it might be launched by mistake and override existing config in a local development environment.

Username and email, but yeah, maybe.

Is the worker guaranteed to be blank for these two settings?

I'm not sure, you'll have to check. I assume if it's not blank then it would be set to a static default?

michelesr · 2026-08-24T10:27:43Z

+
+      - name: Check if release PR is needed
+        id: check
+        run: |


I don't quite follow the rationale of why all this code it's here but a specific bit is a Justfile recipe, can't we make a just command spit out true or false so that we can use it locally to check/troubleshoot?

As with the other one, the whole thing doesn't seem useful as a local script.

The bit that's pulled out to the Justfile is the part that isn't doing simple logic, string parsing, and GITHUB_OUTPUT manipulation.

answered in the other comment already, but I wonder if we can't just move all the business logic into the just recipe so that it behaves like a sort of pure function that answers a boolean question and then leave only the github output manipulation in the body of the step

michelesr · 2026-08-24T10:42:05Z

+      - name: Check if this is a version bump commit
+        id: check
+        run: |
+          # Get the merge commit message


this code could be a just recipe?

Basic if's and string parsing interacting with the GITHUB_OUTPUT directly... it didn't seem to meet the threshold for being in the Justfile (it's not using any other tools, and it's not all that useful locally) so that would just be unnecessary indirection

hmm, can't you have the recipe return true or false, and then write that in the output instead?

michelesr · 2026-08-24T10:47:11Z

+    awk '/^dependencies = \[/,/^\]/' pyproject.toml | sort > "$tmpdir/deps.new"
+
+    # Compare the dependency constraint lists
+    if ! diff -q "$tmpdir/deps.old" "$tmpdir/deps.new" > /dev/null 2>&1; then


This will trigger release for every text change in the dependencies sections of the file, including sorting, commenting, formatting. Something to take in consideration. I wonder if it would be better to use uv commands to actually determine if there was a change.

That was the best way to check if there was actually a change in the constraints. There was no direct uv command to do so that I could find.

Yes, it will pick up new comments as a change as is. Sorting won't, because it sorts the lines as part of generating the deps files. Formatting, yeah, it'll pick up changes in indentation and white space... but what is the likelihood of somebody doing just that, or just adding comments without changing a constraint at the same time?

It could have the dependabot check as well, but I figured that it should be picking up the rarer situations of somebody updating a minimum constraint to ensure the existence of a feature in a library.

if there's no obvious better way to check then I think it's fine

michelesr · 2026-08-24T10:50:38Z

+    git config user.name "github-actions[bot]"
+    git config user.email "github-actions[bot]@users.noreply.github.com"
+
+# CI-only: Create and checkout release branch


I'm not entirely sure all of the following recipes/commands needs to be CI only, some of them could be useful locally too

They can be used locally, but they are predominantly used by the workflow. This was something I couldn't be arsed pushing back against the AI over when it wasn't quite getting the basic logic right.

Do you have a suggestion for better naming, or should I just clear the CI-only from the comments?

Probably a good idea to make them usable locally where possible (of course the git config one needs to be CI only) and remove the ci- prefix from the others?

simonwgill added 9 commits August 17, 2026 14:35

Add dependabot commit filtering to release check

b31515b

Only create release PRs when: - Dependabot commits exist since last tag AND - 4-day cooldown has passed This ensures releases only happen when dependencies have been updated, not on every cron run.

Add version bump and commit step

548e872

Justfile: - ci-bump-and-commit: Bumps version, stages files, and commits Workflow: - Bumps patch version using uv - Creates commit with version in message - Captures new version for next steps Defaults to patch bumps for dependency updates.

Add branch push step

1a1b33d

Justfile: - ci-push-branch: Pushes specified branch to origin Workflow: - Pushes release branch with version bump commit - Uses branch name from earlier step

Replace check for dependabot PRs with check for dependency constraint…

34630dc

… changes

Fixed uv_build version warning

a6351cf

simonwgill requested a review from a team as a code owner August 21, 2026 11:24

github-advanced-security Bot found potential problems Aug 21, 2026

View reviewed changes

Comment thread .github/workflows/04_cron_release.yml Fixed

Add missing permission scope

323eb99

michelesr requested changes Aug 24, 2026

View reviewed changes

Add default git ref value for local usage of dependency check

c90aa28

Uh oh!

Conversation

simonwgill commented Aug 21, 2026

Describe your changes

Checklist before requesting a review

Uh oh!

Uh oh!

michelesr Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

michelesr Aug 24, 2026 •

edited

Loading