Skip to content

Weekly publish of pre-release - #108

Merged
carole-lavillonniere merged 6 commits into
localstackfrom
cosy-807-auto-release-the-lambda-rie-lambda-runtime-init-so-its-go
Aug 13, 2026
Merged

Weekly publish of pre-release#108
carole-lavillonniere merged 6 commits into
localstackfrom
cosy-807-auto-release-the-lambda-rie-lambda-runtime-init-so-its-go

Conversation

@carole-lavillonniere

@carole-lavillonniere carole-lavillonniere commented Jun 30, 2026

Copy link
Copy Markdown

Towards COSY-807.

  • Auto-publish a prerelease of RIE every Friday mornings at 6am UTC, if there are new commits.
  • A new tag with bumped patch is pushed (latest version is fetched from Github releases).
  • The goal is to have vulnerabilities auto-resolve weekly without human intervention.
  • Release can still be done manually if needed
  • If the release job fails, we notify slack channel #core-systems-notifications

Related:

Cut a new patch release once a week when there are new commits on
localstack, so Go-dep/stdlib CVE fixes self-publish without a manual tag.

- weekly-release.yml: Friday cron + workflow_dispatch; discovers the latest
  published release, patch-bumps, skips if no new commits, then calls build.yml.
- build.yml: add workflow_call with an optional version input so the same
  test -> build -> release path publishes the computed version (no PAT needed).
@carole-lavillonniere carole-lavillonniere changed the title Add weekly auto-release workflow for the LocalStack RIE Weekly auto-release Jun 30, 2026
@carole-lavillonniere
carole-lavillonniere marked this pull request as ready for review June 30, 2026 14:26

@dfangl dfangl left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not super happy with the workflow call, but sadly pushes from the github action do not trigger more actions, so this is all we can do I think :P

However, we never really create a tag, right? I think the release action will not create one, and instead this fails. Could you double check or push a tag in the weekly-release workflow?

@carole-lavillonniere

Copy link
Copy Markdown
Author

I am not super happy with the workflow call, but sadly pushes from the github action do not trigger more actions, so this is all we can do I think :P

However, we never really create a tag, right? I think the release action will not create one, and instead this fails. Could you double check or push a tag in the weekly-release workflow?

Added a step to push the tag: 2e08a7d
Since we cannot run this workflow without merging it first, tested by forking the repo and running the workflow here: https://github.com/carole-lavillonniere/lambda-runtime-init/actions/runs/31389766763

@carole-lavillonniere
carole-lavillonniere marked this pull request as draft August 12, 2026 10:06
@carole-lavillonniere carole-lavillonniere changed the title Weekly auto-release Weekly publish of pre-release Aug 12, 2026
@carole-lavillonniere
carole-lavillonniere marked this pull request as ready for review August 13, 2026 12:00

@dfangl dfangl left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now!

@carole-lavillonniere
carole-lavillonniere merged commit 3cf0464 into localstack Aug 13, 2026
3 checks passed
@carole-lavillonniere
carole-lavillonniere deleted the cosy-807-auto-release-the-lambda-rie-lambda-runtime-init-so-its-go branch August 13, 2026 12:49
dfangl pushed a commit that referenced this pull request Sep 1, 2026
…131)

* ci: make a missing Slack webhook a clear failure, not a cryptic one

The weekly release failed on Aug 28 and the alert never reached Slack. The
notify job failed with:

    Missing input! Either a method or webhook is required to take action.

COSY_WEBHOOK_URL resolves to an empty string, so GitHub omits the `webhook`
input entirely and the action rejects the call. The secret exists but was
created 2026-08-12 and never updated -- one day before the weekly release
workflow landed in #108 -- and the notify path was not exercised until the
Aug 28 failure, so this alert has never worked.

Check the webhook in a preflight step that names the missing secret, and set
errors: true so Slack-side delivery failures fail the step instead of
reporting green.

Neither change can populate the secret; that still needs setting in repo
settings. They make the next failure say so in one line.

* ci: send the Slack payload as JSON with a literal-newline message

slack-github-action v4 ships js-yaml v5, which enforces stricter multiline
indentation. MESSAGE was a double-quoted YAML scalar, so its \n\n became real
newlines that were interpolated into the YAML payload at column 0 and broke
the document:

    Invalid input! Failed to parse contents of the provided payload
    SyntaxError: Expected property name or '}' in JSON at position 1

Single-quote MESSAGE so \n stays a two-character escape, and send the payload
as JSON, where an interpolated message cannot break the structure and \n is
exactly the newline Slack mrkdwn renders.

Verified end to end on a throwaway branch: the notify job was forced to run
under dryRun and delivered to Slack with errors: true, so a rejected delivery
would have failed the step.

* ci: drop explanatory comments from the notify job
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants