ci(release): make the release tag-driven (stop pushing to protected main) #14

wtclaude · 2026-07-20T19:00:34Z

wtclaude commented

2026-07-20 19:00:34 +00:00

Why

The push-to-main release model kept failing at the very last step across runs #187 and #194: the job builds and signs the APK fine, then git push origin HEAD:main (the version-bump commit) is rejected by main's branch protection — pre-receive hook declined / Internal Server Error. main is deliberately protected (allowlist push, required approvals, required status checks), which is fundamentally incompatible with a CI job pushing a fresh commit to it.

What changes

Flip the trigger: the workflow now runs on pushing a v* tag (or workflow_dispatch with a tag input). The tag is the release input, so the job never touches protected main.

versionName / versionCode are derived from the tag name (e.g. v0.1.0 → 0.1.0, code 100). The conventional-commit version-planning engine is gone.
app/build.gradle.kts is set for the build only, never committed back.
No git push to main, no tag creation, no REGISTRY_USER — the job only needs REGISTRY_TOKEN to create the Gitea release and upload runic-gateway-<v>.apk + SHA256SUMS.
Changelog is still generated from conventional-commit subjects since the previous tag.
Keeps the speed fixes merged in #13 (trimmed setup-android, no Gradle cache, timeout-minutes: 30).

How to cut a release after this merges

git tag v0.1.0
git push origin v0.1.0

(or create the tag from the Gitea UI, or use Actions → Release APK → Run workflow with the tag). That's the whole flow.

Notes

No leftover state: the previous failed runs tagged v0.1.0 only in their ephemeral runners; no v0.1.0 tag exists in the repo yet.
Validated the YAML parses.

AI disclosure

Authored with assistance from Claude (Claude Code). See commit trailer.

🤖 Generated with Claude Code

## Why The push-to-`main` release model kept failing at the very last step across runs **#187** and **#194**: the job builds and signs the APK fine, then `git push origin HEAD:main` (the version-bump commit) is rejected by `main`'s branch protection — `pre-receive hook declined` / `Internal Server Error`. `main` is deliberately protected (allowlist push, required approvals, required status checks), which is fundamentally incompatible with a CI job pushing a fresh commit to it. ## What changes Flip the trigger: the workflow now runs on pushing a **`v*` tag** (or `workflow_dispatch` with a `tag` input). The tag *is* the release input, so the job never touches protected `main`. - `versionName` / `versionCode` are derived from the **tag name** (e.g. `v0.1.0` → `0.1.0`, code `100`). The conventional-commit version-planning engine is gone. - `app/build.gradle.kts` is set **for the build only**, never committed back. - **No `git push` to main, no tag creation, no `REGISTRY_USER`** — the job only needs `REGISTRY_TOKEN` to create the Gitea release and upload `runic-gateway-<v>.apk` + `SHA256SUMS`. - Changelog is still generated from conventional-commit subjects since the previous tag. - Keeps the speed fixes merged in #13 (trimmed `setup-android`, no Gradle cache, `timeout-minutes: 30`). ## How to cut a release after this merges ``` git tag v0.1.0 git push origin v0.1.0 ``` (or create the tag from the Gitea UI, or use **Actions → Release APK → Run workflow** with the tag). That's the whole flow. ## Notes - No leftover state: the previous failed runs tagged `v0.1.0` only in their ephemeral runners; no `v0.1.0` tag exists in the repo yet. - Validated the YAML parses. ## AI disclosure Authored with assistance from Claude (Claude Code). See commit trailer. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-20 19:00:35 +00:00

ci(release): make the release tag-driven (no push to protected main)

PR Checks / android-build (pull_request) Successful in 10m23s

Details

9268579c5f

The push-to-main release model kept failing: the job builds the signed APK
fine, but the final `git push origin HEAD:main` (version-bump commit) is
rejected by main's branch protection — "pre-receive hook declined / Internal
Server Error" — across runs #187, #194. main is deliberately protected
(allowlist push, required approvals, required status checks), which is
fundamentally incompatible with a CI job pushing a fresh commit to it.

Flip the trigger: the workflow now runs on pushing a `v*` tag (or via
workflow_dispatch with a tag input). The tag *is* the release input, so:

- version/versionCode are derived from the tag name (no version-planning engine);
- app/build.gradle.kts is set for the build only, never committed back;
- no `git push` to main, no tag creation, no REGISTRY_USER needed —
  only REGISTRY_TOKEN, to create the Gitea release + upload the APK/SHA256SUMS.

To cut a release now: `git tag v0.1.0 && git push origin v0.1.0`.

Keeps the speed fixes from #13 (trimmed setup-android, no Gradle cache,
timeout-minutes). Changelog is still generated from conventional-commit
subjects since the previous tag.

Co-Authored-By: Claude <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-20 19:01:31 +00:00

whitlocktech merged commit d0fb6bbdfc into main

2026-07-20 19:11:43 +00:00

whitlocktech referenced this issue from a commit

2026-07-20 19:11:43 +00:00

Merge pull request 'ci(release): make the release tag-driven (stop pushing to protected main)' (#14) from ci/tag-driven-release into main

whitlocktech deleted branch ci/tag-driven-release

2026-07-20 19:11:43 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/Android-app#14