From 3ebd1fa507a0610a1f9f059f576fedb29bc06dcb Mon Sep 17 00:00:00 2001 From: lilleman Date: Wed, 5 Aug 2026 10:15:09 +0200 Subject: [PATCH] Gate the auto-release tag job behind an AUTO_RELEASE variable --- .gitea/workflows/renovate.yml | 3 +++ README.md | 9 +++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index f2e7fe3..bd8b303 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -30,9 +30,12 @@ jobs: # authorship on the tip, so the author checks are reliable. Level = highest `Release-Bump:` trailer; # pre-1.0 shifts down (auto-release/next-version.ts). Tag-only — release.yml promotes the # already-built image; pushed with renovate-bot's PAT so release.yml fires (the built-in token won't). + # Off until the Actions variable AUTO_RELEASE is set to 'true': Plainpages is pre-announcement and + # deliberately carries no tags, so an automated bump would only invent a version nobody consumes. auto-release: runs-on: docker-host needs: renovate + if: vars.AUTO_RELEASE == 'true' steps: - uses: actions/checkout@v7.0.1 with: diff --git a/README.md b/README.md index 8025876..2040093 100644 --- a/README.md +++ b/README.md @@ -1526,7 +1526,7 @@ Gitea Actions (`.gitea/workflows/`) runs the pipeline; the test job runs | `release.yml` | push of a `vX.Y.Z` tag | re-tag that commit's image as `X.Y.Z`, `X.Y`, `X`, `latest`; sync those tags to Docker Hub | | `mirror.yml` | push to `main` or any tag, or manual | force-push `main` + tags to the [GitHub mirror](https://github.com/larvit/plainpages) | | `registry-cleanup.yml` | nightly cron, or manual | delete registry images that are neither release-tagged nor a branch head | -| `renovate.yml` | nightly cron, or manual | open dependency-update PRs, automerge them once the gate is green, then cut one release tag for the run | +| `renovate.yml` | nightly cron, or manual | open dependency-update PRs, automerge them once the gate is green; the release-tag job only runs when `AUTO_RELEASE` is set | `main` is not re-tested on push — its commits are meant to arrive already green from a gated branch, so the status check to gate a merge on is `CI / full-gate (push)`. @@ -1604,8 +1604,13 @@ prefix is rejected). Also store a **scopeless** (read-only) github.com PAT as th lookups of github.com-hosted deps (actions, Playwright, changelogs) run authenticated instead of tripping the anonymous 60-requests/hour limit. +**Releases are paused.** Plainpages is pre-announcement: the repository carries **no tags**, and +neither `release.yml` nor Docker Hub has a version to promote. Turn releasing back on by setting the +Actions **variable** `AUTO_RELEASE` to `true` (that alone re-enables the job below), or cut a +`vX.Y.Z` tag by hand. + **Auto-release on dependency updates** — a second job in `renovate.yml` (`auto-release`, `needs: -renovate`) cuts **one** `vX.Y.Z` tag per run covering the renovate-bot commits merged to `main` +renovate`, gated on `AUTO_RELEASE` above) cuts **one** `vX.Y.Z` tag per run covering the renovate-bot commits merged to `main` since the last tag (it targets `origin/main`, and **skips** when the tip isn't a Renovate commit — a human owns that release — or when nothing new merged). Renovate stamps every commit with a `Release-Bump: ` trailer (`commitBody` in `renovate.json`), and