Release Automation#

Decant's release process is entirely tag-driven. The just release VERSION recipe is the single local entry point: it validates the repository state and creates and pushes a signed, annotated tag that triggers the full CI pipeline.

just release VERSION#

The recipe accepts a semver string without a leading v (e.g., just release 0.2.0). Before touching git, it enforces three guards in sequence:

1. Clean working tree — fails immediately if git status --porcelain produces any output.
2. On main — rejects any non-main branch.
3. Up to date with origin/main — runs git fetch origin main and compares HEAD to origin/main; fails if they diverge.

If all guards pass, it runs git tag -s "v<VERSION>" -m "v<VERSION>" and git push origin "v<VERSION>" 1. Run just check first if you want a local quality gate before tagging 2.

CI pipeline triggered by the tag#

Pushing a v* tag fires .github/workflows/release.yml. The job graph is 3:

meta (guard) → verify → build (+sign +attest) → smoke-darwin
  → npm (OIDC) → npm-smoke → github-release
    → homebrew-formula → homebrew-smoke → tap-update (stable latest only)
  → docker (fans out in parallel, once smoke-darwin passes)

meta is the upstream guard for the entire pipeline 4:

• Strips the leading v and validates the remainder as semver; any mismatch fails immediately.
• Re-fetches the tag from origin and peels it to a commit; requires that commit to equal $GITHUB_SHA, blocking manual dispatches that target a different ref.
• Computes is_latest via a live git ls-remote — a transient failure kills the job rather than silently marking a non-latest version as latest.
• Versions containing - are treated as prereleases and never receive the latest npm dist-tag, :latest Docker tag, or a Homebrew tap update.

smoke-darwin is a hard gate — nothing publishes until both Apple architectures pass 5. npm-smoke gates the GitHub Release on all four OS/arch targets; homebrew-smoke covers three.

Failure recovery#

Every downstream job is idempotent 6. On failure:

• Re-run the failed workflow run directly (reuses the original tag's commit), or
• Dispatch fresh: gh workflow run release.yml --ref vX.Y.Z -f version=X.Y.Z

Do not delete the tag — meta rejects any dispatch whose ref doesn't match the tagged commit, so accidental republishing of a stale version as current is not possible.

Key references#