ci(release): allow entire SDK team to trigger workflows [SDK-4972]#3055
Merged
vgupta98 merged 2 commits intoJun 9, 2026
Merged
Conversation
- Replace 'js-sdk' GitHub team with the broader 'sdk_team' in the validate-actor gate so all SDK-team members (not just js-sdk) can manually trigger release-related workflows - Update draft-new-release, create-hotfix-branch, deploy-beta and rollback to gate on 'sdk_team,integrations' - Update the default team_names in validate-actor to 'sdk_team' Ref: SDK-4972
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR updates GitHub workflow actor validation to use the ChangesTeam name migration from js-sdk to sdk_team
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the release/deploy workflow actor validation to allow a broader SDK team to trigger release-related GitHub Actions workflows.
Changes:
- Changed the default allowed team in
validate-actor.ymlfromjs-sdktosdk_team. - Updated multiple release/deploy workflows to pass
team_names: 'sdk_team,integrations'when calling the actor validation workflow.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/validate-actor.yml | Updates the default allowed team for the reusable actor-validation workflow. |
| .github/workflows/rollback.yml | Updates allowed team list used to authorize rollback workflow triggers. |
| .github/workflows/draft-new-release.yml | Updates allowed team list used to authorize drafting new releases. |
| .github/workflows/deploy-beta.yml | Updates allowed team list used to authorize beta deploy triggers. |
| .github/workflows/create-hotfix-branch.yml | Updates allowed team list used to authorize hotfix branch creation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
The value is used as the team_slug in the GitHub API path
(/orgs/{org}/teams/{slug}/memberships/...), so a display name
would always fail the membership check. Clarify the input
description to avoid that pitfall.
Ref: SDK-4972
saikumarrs
approved these changes
Jun 9, 2026
vgupta98
deleted the
chore/sdk-4972-allow-sdk-team-to-trigger-release-workflows
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Description
The manual-dispatch (
workflow_dispatch) release workflows gate the triggering user throughvalidate-actor.yml, which checks GitHub org team membership. They were configured to allow only thejs-sdkteam (3 members), so other SDK-team members who own a release could not trigger them — during the v3.111.0 release (SDK-4971) the release owner was blocked from runningDraft a new releaseand had to ask ajs-sdkmember to trigger it.This change replaces the
js-sdkteam with the broadersdk_team(the entire SDK team, a superset ofjs-sdk) in the actor allow-list, so any SDK-team member can trigger the release-related workflows. Theintegrationsteam continues to be allowed.Updated workflows:
draft-new-release.yml—team_names: 'sdk_team,integrations'create-hotfix-branch.yml—team_names: 'sdk_team,integrations'deploy-beta.yml—team_names: 'sdk_team,integrations'rollback.yml—team_names: 'sdk_team,integrations'validate-actor.yml— defaultteam_namesupdated to'sdk_team'No change to the validation logic itself, the branch restrictions, or any release behaviour — only the set of teams permitted to trigger.
Linear task (optional)
SDK-4972
Cross Browser Tests
Please confirm you have tested for the following browsers:
Sanity Suite
Security
The actor validation mechanism is unchanged; access is broadened from one SDK sub-team to the parent SDK team only. Branch/tag restrictions on each workflow remain intact.
Summary by CodeRabbit