From 2bbf63195a15c0dc409bf3c0762868d83965004d Mon Sep 17 00:00:00 2001 From: Steve Pelech Date: Thu, 12 Nov 2026 11:23:41 -0600 Subject: [PATCH 1/2] ci(release): pass --repo to gh when triggering the Windows bundle build The release-please job has no checkout, so `gh workflow run` failed with "not a git repository" and no Windows bundle was built for v2.23.0. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-please.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index cee121c..6de33a9 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -24,7 +24,9 @@ jobs: if: ${{ steps.release.outputs.releases_created == 'true' }} run: | echo "Release created for tag: ${{ steps.release.outputs.tag_name }}" + # No checkout in this job: tell gh which repository to use. gh workflow run build-portable-windows.yml \ + --repo "${{ github.repository }}" \ --ref "${{ steps.release.outputs.tag_name }}" \ -f tag_name="${{ steps.release.outputs.tag_name }}" env: From 3e52dbec62e11480b3ea3f9886e3acabf0055c87 Mon Sep 17 00:00:00 2001 From: Steve Pelech Date: Thu, 12 Nov 2026 11:31:56 -0600 Subject: [PATCH 2/2] ci(release): build and attach the Windows bundle from the release-please run Releases and tags created with GITHUB_TOKEN do not trigger other workflows, and the gh workflow run hand-off failed for v2.23.0 ("not a git repository"). The Windows bundle is now a reusable workflow (workflow_call) that release-please.yml calls as a second job when a release is created. - build-portable-windows.yml: workflow_call input tag_name; checks out the release tag; uploads with `gh release upload --clobber` (safe re-runs); verifies that the release has the zip with the built size; one build per tag at a time (concurrency). Manual dispatch with tag_name still works. - release-please.yml: exports releases_created/tag_name and calls the bundle workflow; the actions: write permission is no longer needed. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-portable-windows.yml | 42 +++++++++++++++++--- .github/workflows/release-please.yml | 26 ++++++------ 2 files changed, 51 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build-portable-windows.yml b/.github/workflows/build-portable-windows.yml index d867a96..8b00795 100644 --- a/.github/workflows/build-portable-windows.yml +++ b/.github/workflows/build-portable-windows.yml @@ -15,6 +15,13 @@ on: description: 'pgvector Extension Version' required: false default: '0.8.0' + # Called by release-please.yml after it creates a release (the normal release path). + workflow_call: + inputs: + tag_name: + description: 'Release tag to build from and attach the bundle to' + required: true + type: string release: types: [published] push: @@ -35,10 +42,20 @@ jobs: runs-on: windows-latest permissions: contents: write + # One bundle build per release tag (or per ref for PR/branch builds) at a time. + concurrency: + group: windows-portable-${{ inputs.tag_name || github.event.release.tag_name || github.ref }} + cancel-in-progress: false + env: + # Tag to attach to: workflow_call / workflow_dispatch input, release event, or pushed tag; empty for PR builds. + RELEASE_TAG: ${{ inputs.tag_name || github.event.release.tag_name || (startsWith(github.ref, 'refs/tags/v') && github.ref_name) || '' }} steps: - name: Checkout repository uses: actions/checkout@v4 + with: + # Build exactly the released code when a tag is given. + ref: ${{ inputs.tag_name || github.event.release.tag_name || github.ref }} - name: Set up Python 3.12 uses: actions/setup-python@v5 @@ -129,8 +146,23 @@ jobs: retention-days: 30 - name: Attach Portable Bundle to GitHub Release - if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'release' || github.event.inputs.tag_name != '' - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ github.event.release.tag_name || github.event.inputs.tag_name || '' }} - files: dist/contextcortex-windows-x64-portable.zip + if: env.RELEASE_TAG != '' + shell: pwsh + env: + GH_TOKEN: ${{ github.token }} + run: | + # --clobber replaces an asset from an earlier run, so a re-run is safe. + gh release upload "$env:RELEASE_TAG" "dist/contextcortex-windows-x64-portable.zip" --clobber --repo "${{ github.repository }}" + if ($LASTEXITCODE -ne 0) { throw "Upload to release $env:RELEASE_TAG failed" } + + - name: Verify the Release Asset + if: env.RELEASE_TAG != '' + shell: pwsh + env: + GH_TOKEN: ${{ github.token }} + run: | + $local = (Get-Item "dist/contextcortex-windows-x64-portable.zip").Length + $asset = gh release view "$env:RELEASE_TAG" --repo "${{ github.repository }}" --json assets --jq '.assets[] | select(.name == "contextcortex-windows-x64-portable.zip") | .size' + if (-not $asset) { throw "Release $env:RELEASE_TAG has no contextcortex-windows-x64-portable.zip" } + if ([int64]$asset -ne $local) { throw "Release asset size $asset differs from the built zip ($local bytes)" } + Write-Host "Release $env:RELEASE_TAG has contextcortex-windows-x64-portable.zip ($asset bytes)." -ForegroundColor Green diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6de33a9..748ca93 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -8,11 +8,13 @@ on: permissions: contents: write pull-requests: write - actions: write jobs: release-please: runs-on: ubuntu-latest + outputs: + releases_created: ${{ steps.release.outputs.releases_created }} + tag_name: ${{ steps.release.outputs.tag_name }} steps: - uses: googleapis/release-please-action@v4 id: release @@ -20,14 +22,14 @@ jobs: config-file: release-please-config.json manifest-file: .release-please-manifest.json - - name: Trigger Windows Portable Bundle Build - if: ${{ steps.release.outputs.releases_created == 'true' }} - run: | - echo "Release created for tag: ${{ steps.release.outputs.tag_name }}" - # No checkout in this job: tell gh which repository to use. - gh workflow run build-portable-windows.yml \ - --repo "${{ github.repository }}" \ - --ref "${{ steps.release.outputs.tag_name }}" \ - -f tag_name="${{ steps.release.outputs.tag_name }}" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + # Releases and tags created with GITHUB_TOKEN do not trigger other workflows + # (release: published / push: tags), so the Windows bundle is built and + # attached here, as a reusable workflow in the same run. + windows-portable-bundle: + needs: release-please + if: ${{ needs.release-please.outputs.releases_created == 'true' }} + permissions: + contents: write + uses: ./.github/workflows/build-portable-windows.yml + with: + tag_name: ${{ needs.release-please.outputs.tag_name }}