Skip to content

ci: add monthly release please automation #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 4 commits into
base: master
Choose a base branch
from
Open

ci: add monthly release please automation #30

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
84d5667
Initial plan
Copilot Mar 9, 2026
e5554c4
ci: add monthly release please automation
Copilot Mar 9, 2026
75d256c
Update .github/workflows/release-please.yml
alexdresko Mar 9, 2026
436443b
ci: run release please monthly
Copilot Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 84 additions & 0 deletions .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,97 @@ on:
push:
branches:
- master
schedule:
- cron: "0 3 1 * *"
workflow_dispatch:

permissions:
contents: write
pull-requests: write

jobs:
update-dependencies:
if: ${{ github.event_name != 'push' }}
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Check whether 30 days have passed since the latest tag
id: cadence
shell: bash
run: |
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi

latest_tag="$(git tag --sort=-creatordate | head -n 1)"

if [[ -z "$latest_tag" ]]; then
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi

now_epoch="$(date -u +%s)"
last_tag_epoch="$(git log -1 --format=%ct "$latest_tag")"
thirty_days=$((30 * 24 * 60 * 60))

if (( now_epoch - last_tag_epoch >= thirty_days )); then
echo "should_run=true" >> "$GITHUB_OUTPUT"
else
echo "should_run=false" >> "$GITHUB_OUTPUT"
fi

- name: Setup .NET
if: ${{ steps.cadence.outputs.should_run == 'true' }}
uses: actions/setup-dotnet@v4
with:
dotnet-version: |
8.0.x
9.0.x
10.0.x

- name: Update NuGet dependencies
if: ${{ steps.cadence.outputs.should_run == 'true' }}
run: dotnet package update --project ./EasyScrutor.sln

Copilot AI Mar 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dotnet package update command does not accept a --project flag when targeting a .sln file. For a solution file, the correct invocation is either dotnet package update ./EasyScrutor.sln (passing the .sln as a positional argument) or iterating over individual project files. The --project flag is used with dotnet commands that target a project, not a solution. This step will fail at runtime with an unrecognized option error.

Suggested change
run: dotnet package update --project ./EasyScrutor.sln
run: dotnet package update ./EasyScrutor.sln

Copilot uses AI. Check for mistakes.

- name: Restore dependencies
if: ${{ steps.cadence.outputs.should_run == 'true' }}
run: dotnet restore ./EasyScrutor.sln

- name: Verify code formatting
if: ${{ steps.cadence.outputs.should_run == 'true' }}
run: dotnet format ./EasyScrutor.sln --verbosity diagnostic

- name: Build
if: ${{ steps.cadence.outputs.should_run == 'true' }}
run: dotnet build ./EasyScrutor.sln --configuration Release --no-restore

- name: Run tests
if: ${{ steps.cadence.outputs.should_run == 'true' }}
run: dotnet test ./EasyScrutor.sln --configuration Release --no-build --verbosity normal

- name: Create pull request
if: ${{ steps.cadence.outputs.should_run == 'true' }}
uses: peter-evans/create-pull-request@v7
with:
branch: automation/monthly-dependency-updates
delete-branch: true
commit-message: "fix(deps): update dependencies"
title: "fix(deps): update dependencies"
Comment on lines +80 to +87

Copilot AI Mar 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The create-pull-request action is not given an explicit token: input. By default it uses GITHUB_TOKEN, but PRs opened by GITHUB_TOKEN will not trigger other GitHub Actions workflows (such as the .NET Core CI workflow in netcore.yml). This means the dependency-update PR will be created but its CI checks will never run automatically. To allow the PR to trigger workflows, a Personal Access Token (PAT) or a GitHub App token with the appropriate scopes should be passed as the token: input.

Copilot uses AI. Check for mistakes.

@alexdresko alexdresko Mar 9, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot I do not understand what is being said here.

Copilot AI Mar 9, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It means the PR would still be created, but because create-pull-request would use the default GITHUB_TOKEN, GitHub would not start the normal PR workflows on that generated PR. In practice, the dependency-update PR could open without the .NET Core CI checks running automatically. To make those checks run, this action would need an explicit token from a PAT or GitHub App secret instead of relying on the default token.

@alexdresko alexdresko Mar 9, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot What is the modern, common way of achieving the desired result? I'm looking for ideas.

Copilot AI Mar 9, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The most common modern approach is to have the automation use a GitHub App token or a fine-grained PAT stored as a repository secret, then pass that token into peter-evans/create-pull-request. That way the bot-created PR is treated more like a normal user-created PR, so your pull_request workflows such as .NET Core CI will run.

A second common option is to use Dependabot or Renovate, since they already solve this pattern well and their PRs usually integrate cleanly with CI and branch protection.

If you want to keep this custom workflow, my recommendation would be: create a dedicated bot/App token with the minimum needed repo scopes, store it as a secret, and wire it into the token: input for the PR creation step.

@alexdresko alexdresko Mar 9, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot Let's discuss Dependabot and Renovate.

body: |
## Summary
- update NuGet dependencies used by the solution
- verify formatting, build, and tests before opening the PR

## Notes
- merging this PR will allow the existing release workflow to publish the next package version

release-please:
if: ${{ github.event_name == 'push' }}
runs-on: ubuntu-latest
outputs:
release_created: ${{ steps.release.outputs.release_created }}
Expand Down
Loading