From efbcb01b7747a409459c7788826118856b3bc9c8 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Tue, 6 Oct 2026 02:08:46 -0400 Subject: [PATCH] CI: build workflows run only from the release branch Release, FreeBSD and Windows ARM64 builds no longer run on main, PRs or a schedule; every build job checks for refs/heads/release so a manual run from another branch is skipped. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/freebsd.yml | 12 +++--------- .github/workflows/release.yml | 2 ++ .github/workflows/windows-arm64.yml | 14 +++----------- docs/releasing.md | 17 +++++++++++------ 4 files changed, 19 insertions(+), 26 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 615ef5035..3e2370996 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -1,5 +1,7 @@ # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter. +# Builds run only from the `release` branch: release.yml calls this workflow, and a manual run +# from any other branch is skipped. # # With `package: true` (release.yml calls it that way, or a manual run) it instead builds the # release binaries and uploads `gridcraft--freebsd-x86_64.tar.gz` as the @@ -8,15 +10,6 @@ name: FreeBSD on: - push: - branches: [main] - pull_request: - paths: - - Cargo.toml - - Cargo.lock - - "**/Cargo.toml" - - packaging/freebsd/** - - .github/workflows/freebsd.yml workflow_dispatch: inputs: package: @@ -48,6 +41,7 @@ permissions: jobs: freebsd: name: FreeBSD 14 (${{ inputs.package && 'package' || 'build + test' }}) + if: github.ref == 'refs/heads/release' runs-on: ubuntu-latest timeout-minutes: 300 env: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d38cdf8ee..9a77f105b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,6 +35,8 @@ env: jobs: version: name: version + # Only the release branch builds; a manual run from any other branch skips every job. + if: github.ref == 'refs/heads/release' runs-on: ubuntu-latest environment: release outputs: diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml index 81a4bfc52..7a8aa43cf 100644 --- a/.github/workflows/windows-arm64.yml +++ b/.github/workflows/windows-arm64.yml @@ -4,19 +4,10 @@ # out for now: PrintCraft saw an intermittent access violation in egui UI tests there.) name: Windows ARM64 +# Builds run only from the `release` branch (a manual run from another branch is skipped). on: push: - branches: [main] - pull_request: - paths: - - Cargo.toml - - Cargo.lock - - "**/Cargo.toml" - - "**/build.rs" - - .github/workflows/windows-arm64.yml - - packaging/windows/** - schedule: - - cron: "41 4 * * 1" # weekly, so drift in the runner images shows up + branches: [release] workflow_dispatch: concurrency: @@ -33,6 +24,7 @@ env: jobs: package: name: package (cross-compiled on x64) + if: github.ref == 'refs/heads/release' runs-on: windows-latest timeout-minutes: 90 steps: diff --git a/docs/releasing.md b/docs/releasing.md index 42c6ceb2d..81761c7ae 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -148,7 +148,7 @@ Locally (on Linux): install [nfpm](https://nfpm.goreleaser.com/install/), then ### FreeBSD GitHub has no FreeBSD runners. `.github/workflows/freebsd.yml` boots a FreeBSD 14.3 VM -(`vmactions/freebsd-vm`). On `main` pushes and PRs it builds and tests the workspace; called +(`vmactions/freebsd-vm`). Run by hand from `release`, it builds and tests the workspace; called from `release.yml` with `package: true` it runs `packaging/freebsd/package.sh`, which builds the release binaries and writes `gridcraft--freebsd-x86_64.tar.gz` (`bin/` + `share/`, extract under `/usr/local`). The target dir lives outside the synced checkout so only `dist/release` @@ -184,8 +184,9 @@ shows a `::warning::`. Never store these as org- or repo-level Actions secrets ( `GITHUB_TOKEN` creates the release; only the final job gets `contents: write`. -The exact commands (from craftrules `release/signing-setup.md`, steps 1–3). **Run by an org -admin; not done by the setup agent.** +The exact commands (from craftrules `release/signing-setup.md`, steps 1–3), run by an org +admin. Done for storytold/gridcraft on 2026-10-07; the `release-managers` team also has write +access to the repo, which its ruleset bypass needs. ```sh REPO=storytold/gridcraft @@ -244,7 +245,11 @@ row in `ATTRIBUTION.md` (`cargo xtask assets`). - `.github/workflows/packaging-lint.yml` (seconds, on changes to `packaging/`, the workflows or the icons): actionlint, shellcheck, a PowerShell parse, xmllint, a WiX icon-id check, `desktop-file-validate`, `appstreamcli validate`, and a Flatpak manifest check. -- `.github/workflows/windows-arm64.yml`: packages ARM64 on x64, then installs, runs and - uninstalls the MSI on a Windows 11 ARM64 runner. -- `.github/workflows/freebsd.yml`: FreeBSD build + tests on `main`. +- `.github/workflows/windows-arm64.yml` (on `release` pushes): packages ARM64 on x64, then + installs, runs and uninstalls the MSI on a Windows 11 ARM64 runner. +- `.github/workflows/freebsd.yml`: FreeBSD build + tests (manual run from `release`). + +**Only the `release` branch builds.** No build workflow runs on `main` or pull requests; every +build job checks `github.ref == 'refs/heads/release'`, so a manual run from another branch is +skipped. Only `packaging-lint.yml` (no build, no secrets) runs on `main` and PRs. - Locally: `cargo xtask ci` (fmt, clippy, tests, assets, layers, wasm, parity check).