From 17d3dea8069109e948d667de46716224aea8024c Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 24 Oct 2026 14:48:57 +0200 Subject: [PATCH 1/2] ci: pin the release workflows to obsidian-plugin-workflows v4.1.0 v4.1.0 (149e3780) pins every action to a commit, drops three third-party actions and makes release tags immutable. The workflow_call inputs, secrets and permissions of release-prepare, release-validate and release are unchanged. --- .github/workflows/release-prepare.yml | 2 +- .github/workflows/release-trigger.yml | 2 +- .github/workflows/release.yml | 2 +- AGENTS.md | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index b3007adf..f47d8f72 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -41,7 +41,7 @@ jobs: permissions: contents: write pull-requests: write - uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-prepare.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4 + uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-prepare.yml@149e37801b35c120660a1fd5e78a5471fda55726 # v4.1.0 with: plugin-name: podnotes package-manager: npm diff --git a/.github/workflows/release-trigger.yml b/.github/workflows/release-trigger.yml index 8bf53664..3ff58589 100644 --- a/.github/workflows/release-trigger.yml +++ b/.github/workflows/release-trigger.yml @@ -40,7 +40,7 @@ jobs: actions: write contents: write pull-requests: read - uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-validate.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4 + uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release-validate.yml@149e37801b35c120660a1fd5e78a5471fda55726 # v4.1.0 with: pr-number: ${{ github.event.pull_request.number || inputs.pr-number }} plugin-name: podnotes diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f38a494c..f6bb582e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,7 +30,7 @@ jobs: contents: write id-token: write pull-requests: read - uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release.yml@ebcf84b80dc48ba15e0eec1f3575d41519a78ed5 # v4 + uses: chhoumann/obsidian-plugin-workflows/.github/workflows/release.yml@149e37801b35c120660a1fd5e78a5471fda55726 # v4.1.0 with: release-pr: ${{ inputs.releasePr }} plugin-name: podnotes diff --git a/AGENTS.md b/AGENTS.md index d8da889a..077143ba 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -314,8 +314,8 @@ when the GitHub release is public, its tag points at the release commit, and `main.js` and `manifest.json` match their recorded SHA-256 digests. Three workflows in `.github/workflows/` call reusable workflows in -`chhoumann/obsidian-plugin-workflows` pinned to v4 -(`ebcf84b80dc48ba15e0eec1f3575d41519a78ed5`): +`chhoumann/obsidian-plugin-workflows` pinned to v4.1.0 +(`149e37801b35c120660a1fd5e78a5471fda55726`): 1. `Prepare release` (`release-prepare.yml`) runs after a green `Test` push run on `master`, or by `workflow_dispatch` with an optional `targetSha`. It skips From fadb11b637f13c5db4a2eaa5151935a5e590a322 Mon Sep 17 00:00:00 2001 From: Christian Bager Bach Houmann Date: Sat, 24 Oct 2026 14:49:11 +0200 Subject: [PATCH 2/2] ci: let a manual Prepare release run plan without touching the release PR A dryRun dispatch input forwards to the reusable workflow's dry-run, which skips the job that opens, refreshes or closes release PRs. The workflow_run path passes false, as before. --- .github/workflows/release-prepare.yml | 7 ++++++- AGENTS.md | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index f47d8f72..4137e4db 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -22,6 +22,11 @@ on: description: "Commit SHA to plan from (defaults to the default-branch head)" required: false type: string + dryRun: + description: "Plan only: compute the version and notes, open no release PR" + required: false + type: boolean + default: false permissions: {} @@ -52,6 +57,6 @@ jobs: target-sha: ${{ github.event.workflow_run.head_sha || inputs.targetSha }} release-bot-app-slug: podnotes-release-bot app-id: ${{ vars.RELEASE_APP_ID }} - # dry-run: true # plan only; skip opening the PR (smoke test) + dry-run: ${{ inputs.dryRun == true }} secrets: release-app-private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} diff --git a/AGENTS.md b/AGENTS.md index 077143ba..9007048c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -331,6 +331,8 @@ Three workflows in `.github/workflows/` call reusable workflows in `release(version): Release `, with the generated notes in its body. It changes exactly `package.json`, `package-lock.json`, `manifest.json`, and `versions.json`. Release PRs that a newer plan supersedes are closed. + Dispatch it with `dryRun` set to `true` to plan without opening or + refreshing the release PR. 2. `Trigger release` (`release-trigger.yml`) runs on `pull_request_target` `closed` for a merged `release/*` PR into `master`. It validates the bot author, branch, title, exact version-file diff, merger, squash parent, and