remove internal build type, require approval/verification for releasing all production platforms#8525
Merged
remove internal build type, require approval/verification for releasing all production platforms#8525
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
Author
|
We may want to deploy only the build type simplification, but not the approval step, or vice versa, but this addresses both concerns from https://github.com/getlantern/engineering/issues/3072 |
jay-418
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the deprecated internal build type from CI versioning/release tooling and introduces an approval gate (via a GitHub Environment) before running an “all platforms” production release, with a Slack notification to prompt reviewers.
Changes:
- Remove
internalbuild handling fromscripts/ci/version.shand align nightly/beta version generation to use production/beta tags only. - Update CI helper scripts’ documented build types and release-notes formatting to drop
internal. - Update the release workflow to (a) remove
internalas an option and (b) add Slack notification + environment-based approval before production “all platforms” builds proceed.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
scripts/ci/version.sh |
Drops internal tag handling and updates version generation/validation to consider production+beta only. |
scripts/ci/publish-to-s3.sh |
Updates usage/docs to remove internal build type. |
scripts/ci/format.sh |
Removes internal release-notes formatting and updates documented build types. |
.github/workflows/release.yml |
Removes internal paths and adds Slack notify + environment approval gate for production releases targeting all platforms. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
216
to
+222
| build-macos: | ||
| needs: [set-metadata, release-create] | ||
| needs: [set-metadata, release-create, release-approval] | ||
| uses: ./.github/workflows/build-macos.yml | ||
| secrets: inherit | ||
| if: ${{ needs.set-metadata.outputs.platform == 'all' || contains(needs.set-metadata.outputs.platform, 'macos') }} | ||
| if: | | ||
| (needs.release-approval.result == 'success' || needs.release-approval.result == 'skipped') && | ||
| (needs.set-metadata.outputs.platform == 'all' || contains(needs.set-metadata.outputs.platform, 'macos')) |
Comment on lines
+206
to
+212
| release-approval: | ||
| needs: [set-metadata, release-notify] | ||
| if: | | ||
| needs.set-metadata.outputs.build_type == 'production' && | ||
| needs.set-metadata.outputs.platform == 'all' | ||
| runs-on: ubuntu-latest | ||
| environment: production |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
internalbuild typesrationale
We want to be 100% sure we intend to release to the platforms for which we've pushed a tag. To make this require more than a single push, and allow opportunity for double check, we'll setup an environment for each deploy target, and require that target name to be clicked by someone (anyone) for the production build to proceed. (video below)
Screen.Recording.2026-03-12.at.18.34.16.mov