ci(release): automate signed release tags and release notes by bircni · Pull Request #39544 · go-gitea/gitea

bircni · 2026-10-02T14:40:41Z

Automate release tagging as proposed in #39544 (comment), part of #39550.

A maintainer selects a release branch and version in the release-create-tag workflow. After approval through the release-signing environment, it pushes a GPG-signed tag. The tag starts the existing release build, which generates GitHub release notes with git-cliff from commits since the previous release, excluding PRs labeled skip-changelog.

CHANGELOG.md and release-candidate releases are removed. The workflow reuses the existing GPGSIGN_KEY, GPGSIGN_PASSPHRASE, and RELEASE_TOKEN repository secrets.

Before using the workflow:

Configure the release-signing environment for release/v* branches with maintainers as required reviewers.
Optionally enable immutable releases.

Closes #39550

silverwind · 2026-10-02T15:43:59Z

I propose we make it work like this:

The release commit/tag creation should be callable via on: workflow_dispatch, e.g. triggered on GitHub UI by a maintainer or higher permission.

create auto-generated changelog since last tag on the branch, sectioned via conventional commits
create a commit titled "v1.2.3" with changelog in body, signed with gpg key
create a annotated tag on the release commit with the changelog in body, signed with gpg key

On tag creation (on: tags: **), the release workflow should then run and:

build the binaries and attach them to a new immutable github release
publish and upload the binaries to gitea.com
publish to other ecosystems like snap store

Blog post stays a manual optional action following the release.

Release commit could stay optional if no files change in the repo on release, but I prefer to have it to mark the release in the commit history.

silverwind · 2026-10-03T10:56:10Z

Just delete CHANGELOG.md

Copilot

Copilot review overview

🟡 Changes recommended

The cliff.toml BREAKING parser misclassifies ordinary conventional commits; the upgrade prompt also needs terminology updates.

Review effort: Lite
Findings: 1

Open (1)

Make the breaking commit marker mandatory · New

What changed in this PR

Automates release-note generation and GPG-signed release tagging through GitHub Actions.

Changes:

Adds validation, authorization, dry-run, signing, and atomic publication.
Configures git-cliff and documents the release process.
Updates release references and spellcheck inputs.

File	Description
`tools/release-tag.py`	Validates release inputs and repository state.
`README.zh-tw.md`	Updates translated security guidance.
`README.zh-cn.md`	Updates translated security guidance.
`README.md`	Updates security patch guidance.
`Makefile`	Includes current files in spellchecking.
`docs/release-management.md`	Documents the new release process.
`contrib/upgrade.sh`	Links users to GitHub Releases.
`cliff.toml`	Defines release-note formatting and grouping.
`CHANGELOG-archived.md`	Points to current GitHub releases.
`.github/workflows/release-create-tag.yml`	Orchestrates preview, signing, and publication.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

bircni · 2026-10-03T11:00:14Z

Just delete CHANGELOG.md

completely? what about the archived one?

Generate release notes during publication and keep signed commit and tag messages short. Add a local script for deployment, Helm, and Terraform update PRs.

silverwind · 2026-10-03T14:11:54Z

Doing some cleanups, also I'm sceptical regarding cliff, so I'm checking for alternatives too.

bircni · 2026-10-03T15:23:38Z

I really like cliff - 100% would recommend

Gitea releases change no files, so a release commit only added the need for branch push rights and a race with new merges. The workflow now pushes a signed annotated tag on the approved branch head, with release notes in its body that a small ci-tools command generates from the conventional commit titles, reusing the PR title parser instead of git-cliff. The first release of a line starts its notes at the -dev tag of its fork point. The downstream update script is left for a separate PR. Assisted-by: Claude Code:claude-opus-5-5

silverwind · 2026-10-03T15:37:56Z

Pushed a rework in 6f3653e:

Release notes come from a small release-notes command in tools/ci-tools.ts that groups the conventional commit titles with the existing PR title parser, replacing git-cliff and the TypeScript release tools.
The workflow is a single job behind the release-signing environment that pushes only a signed annotated tag with the notes in its body. There is no release commit, since releases change no files.
The previous release is the nearest tag of the same minor line, including the -dev tag at the release branch fork point, so the first release of a line gets correct notes.
The tag workflow takes the GitHub release notes from the tag body.
.changelog.yml and the skip-changelog labeling are removed, and tools/release-updates.ts is left for a separate PR.

This comment was written by Claude.

bircni · 2026-10-03T15:40:48Z

The workflow is a single job behind the release-signing environment that pushes only a signed annotated tag with the notes in its body. There is no release commit, since releases change no files.

Didnt we say we dont put the notes in its body.

The tag workflow takes the GitHub release notes from the tag body.

Not what we wanted

.changelog.yml and the skip-changelog labeling are removed, and tools/release-updates.ts is left for a separate PR.

why - remove it I like the label and it makes it visible more clear that this is not changelog relevant

silverwind · 2026-10-03T15:41:44Z

I don't know about cliff. It's default template includes emoji, so needs a custom template in a strange language. Currently I have this in ci-tools.

silverwind · 2026-10-03T16:09:06Z

My only reason is that I've been doing it that way in all my repos because I think it's only logical and adds useful info to the tag, but no strong feeling about it.

wxiaoguang · 2026-10-03T16:09:58Z

My only reason is that I've been doing it that way in all my repos because I think it's only logical and adds useful info to the tag, but no strong feeling about it.

How other open source projects do? Or just "do as the Romans do"?

Keep the signed tag message to the version and generate the release notes when the tag build creates the GitHub release, as discussed in the review, so the tag stays small and the notes come from the same place that publishes them. Assisted-by: Claude Code:claude-opus-5-5

silverwind · 2026-10-03T16:13:10Z

I'll remove it then, IDK how common it is to have messages in tags. I think most repos do not care because UI does not expose tag messages prominently.

silverwind · 2026-10-03T16:38:57Z

Doing final cleanup now.

silverwind · 2026-10-03T16:41:56Z

After this is merged and before the release is done, enable this in GitHub UI at https://github.com/go-gitea/gitea/settings:

Pick the previous release as the highest stable version below the new tag, which gives the same commit range as the -dev tags without needing them. The skip-changelog label alone decides what is left out, since the labeler already applies it to chore and ci PRs. The git-cliff action runs git-cliff twice, so it uses RELEASE_TOKEN for the larger API rate limit. The workflows, config and docs lose what that made redundant. Assisted-by: Claude Code:claude-opus-5-5

bircni · 2026-10-03T16:50:43Z

@lunny we need the secrets configured

bircni · 2026-10-03T16:51:44Z

@@ -0,0 +1,10 @@
+[git]
+commit_parsers = [
+  { field = "remote.pr_labels", pattern = "^skip-changelog$", skip = true },


@silverwind why not skip per type?

Because skip-changelog could be added manually.

Then the type is wrong

What type? We have 2 types that imply skip-changelog. And users should be free to manually set the label.

Thought I guess it is unlikely that it's needed so it could be purely type-based too and then we should delete the label because it serves no purpose.

I wouldn't support that
Give me one real reason how this could happen

Why would you call a commit "feat" and skip changelog

adjusted to what? don't force me to read the diff.

bircni@5fb4824

@wxiaoguang whats your opinion?

I have no opinion actually. Either is fine ( label-only, commit-message-only, commit-message + label)

(It's just unclear to me what we would do with "skip-changelog" label in the future)

Update: see next comment

"What type? We have 2 types that imply skip-changelog. And users should be free to manually set the label."

I think it is true.

For example: a feature landed on main branch, then a follow-up "fix" to correct it. The "fix" prefix is correct because it does fix bugs, but we don't need to mention such follow-up fix in changelog, since it belongs to the feature.

Assisted-by: Claude Code:claude-opus-5-5

Release branches are already described in the versions section. Assisted-by: Claude Code:claude-opus-5-5

lunny · 2026-10-03T19:51:47Z

I think we already have GPGSIGN_KEY and GPGSIGN_PASSPHRASE which could be reused and RELEASE_TOKEN is already ready.

bircni · 2026-10-03T19:54:27Z

I think we already have GPGSIGN_KEY and GPGSIGN_PASSPHRASE which could be reused and RELEASE_TOKEN is already ready.

Which email address is registered to it?

lunny · 2026-10-03T22:26:33Z

GPGSIGN_KEY

teabot [at] gitea.io

bircni · 2026-10-03T22:35:21Z

@lunny @silverwind

created the environment + adjusted the identity + adjusted the secrets - should be ready now

bircni · 2026-10-03T22:47:47Z

its ready

bircni · 2026-10-04T07:58:53Z

@silverwind we forgot one point - the security section

ci(release): automate changelog preparation and signed release tagging

f3c963f

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 2, 2026

github-actions Bot added the skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. label Oct 2, 2026

bircni added the backport/v28 This PR should be backported to Gitea 28 label Oct 2, 2026

bircni added 2 commits October 2, 2026 23:05

ci(release): generate notes for signed release commits and tags

f1a6ecb

Merge branch 'main' into ci/release-automation

d851345

bircni requested review from lunny and silverwind and a lite review from Copilot October 2, 2026 21:06

Copilot started reviewing on behalf of bircni October 3, 2026 10:54 View session

docs(release): preserve changelog in archive

68fca5b

bircni force-pushed the ci/release-automation branch from 2746691 to 68fca5b Compare October 3, 2026 10:56

Copilot AI reviewed Oct 3, 2026

View reviewed changes

Comment thread cliff.toml Outdated

bircni added 2 commits October 3, 2026 13:00

remove changelog

6480f3a

adjust parsing

7052fe8

bircni requested a review from a team October 3, 2026 11:34

wxiaoguang reviewed Oct 3, 2026

View reviewed changes

Comment thread .github/workflows/release-create-tag.yml Outdated

wxiaoguang reviewed Oct 3, 2026

View reviewed changes

Comment thread tools/release-tag.py Outdated

bircni and others added 2 commits October 3, 2026 14:24

ci(release): drop release candidate support

6a767dd

ci(release): migrate tooling to TypeScript

e0cfe60

Generate release notes during publication and keep signed commit and tag messages short. Add a local script for deployment, Helm, and Terraform update PRs.

bircni requested a review from wxiaoguang October 3, 2026 12:29

Merge branch 'main' into ci/release-automation

3c8b6de

silverwind changed the title ~~ci(release): automate changelog preparation and signed release tagging~~ ci(release): automate signed release tags and release notes Oct 3, 2026

silverwind approved these changes Oct 3, 2026

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 3, 2026

bircni commented Oct 3, 2026

View reviewed changes

silverwind added 2 commits October 3, 2026 18:58

docs(release): say that release-create-tag is run from the Actions tab

a31578c

Assisted-by: Claude Code:claude-opus-5-5

docs(release): drop the feature freeze, Gitea does not have one

9c73422

Release branches are already described in the versions section. Assisted-by: Claude Code:claude-opus-5-5

bircni added 2 commits October 4, 2026 00:33

adjust secrets

43c28f4

email

88ea4cb

bircni added 2 commits October 4, 2026 00:45

switch to skip changelog by type

5fb4824

add issue draft

b1e201c

bircni requested a review from silverwind October 3, 2026 22:47

GiteaBot added lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Oct 3, 2026

Merge branch 'main' into ci/release-automation

22b4925

Uh oh!

Conversation

bircni commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silverwind commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

bircni commented Oct 3, 2026

Uh oh!

Uh oh!

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

bircni commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

bircni commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

wxiaoguang commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026

Uh oh!

silverwind commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bircni commented Oct 3, 2026

Uh oh!

bircni Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

bircni Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bircni Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bircni Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

bircni Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lunny commented Oct 3, 2026

Uh oh!

bircni commented Oct 3, 2026

bircni commented Oct 2, 2026 •

edited

Loading

silverwind commented Oct 2, 2026 •

edited

Loading

silverwind commented Oct 3, 2026 •

edited

Loading

silverwind Oct 3, 2026 •

edited

Loading

silverwind Oct 4, 2026 •

edited

Loading

wxiaoguang Oct 4, 2026 •

edited

Loading