Repository navigation
Conversation
Every push to main ran the release build and pushed Core and Pro to NuGet. Dependabot security updates always target the default branch, so merging them on 2026-10-20 published an unplanned 4.7.1. A release-gate job now looks up the PR behind the pushed commit and allows the build only when its head branch is develop or release/*, or when the workflow is run manually. The release notes step reads that PR instead of the most recently closed one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The release gate validates github.sha, but checkout uses the moving github.ref, allowing an unvalidated commit to be packaged and published with mismatched PR notes.
1 open issue
What changed in this PR
Restricts GeoBlazor Core and Pro releases to prevent routine merges into main, such as Dependabot updates, from triggering unintended NuGet publications.
Changes:
- Gates publishing on merged PRs from
developorrelease/*, while allowing manual runs. - Uses the matched PR’s body for release notes instead of the most recently closed PR.
- Bumps Core and Pro build versions from
4.7.0.5to4.7.0.6.
| File | Description |
|---|---|
pro/Directory.Build.props |
Bumps the Pro build version to 4.7.0.6. |
Directory.Build.props |
Bumps the Core build version to 4.7.0.6. |
.github/workflows/main-release-build.yml |
Adds the release gate and ties release notes to the matched PR. |
Review effort: Balanced
|
|
||
| build: | ||
| needs: release-gate | ||
| if: needs.release-gate.outputs.should-release == 'true' |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every push to
mainranmain-release-build.yml, which builds and pushes Core and Pro to NuGet. Dependabot security updates always target the default branch, so merging a batch of them today published an unplanned 4.7.1. That version has the same library code as 4.7.0, plus a bump to the Core test app.Changes
release-gatejob looks up the PR merged by the pushed commit.buildandnuget-pushrun only when that PR's head branch isdeveloporrelease/*, or when the workflow is started manually.picomatchbump as its notes.Testing
release-gate→build→nuget-push.gh apiquery against real commits: the Bump picomatch from 2.3.1 to 2.3.2 in /src/dymaptic.GeoBlazor.Core #549 merge resolves to adependabot/...head and would be skipped, and the 4.7.0 release merge resolves to Release v4.7.0 #542 fromdevelopand would publish.main.This lands on
mainwith the next release. Until then, merging a Dependabot PR onmainstill publishes.🤖 Generated with Claude Code