Develop - #85
Merged
Merged
Conversation
…merge to main A push to main took desktop/package.json literally: if that version had already shipped, preflight set should_release=false and every build job was skipped, so the merge produced no release at all and nothing failed loudly. package.json sat at 1.0.43 while production was on v1.0.46. Shipping therefore meant committing a bump to develop and merging to main a second time. main now runs the same "bump patch until unreleased" loop develop already used, so a develop -> main merge always ships. An explicit workflow_dispatch version is still taken literally and still skipped when that release exists, so a release number can be pinned by hand. v<x> and the dev prereleases v<x>-dev.<n> are distinct tags and semver sorts the prerelease below the release, so promoting the version the dev channel has been building is correct. A new bump-develop-version job then writes the next patch back into desktop/package.json on develop so the committed number tracks reality. It never moves the version backwards, no-ops when already correct, and rebase-retries if develop moved. It pushes to develop and never main: a bot commit touching desktop/** on main would retrigger this workflow and immediately release the bumped version. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The seven `scripts/prod-*` files are single-use fixes against LIVE data — a specific incident, a specific date range, hardcoded prod user ids. They are not tooling, and the danger of tracking them is that they read as tooling: someone finds `prod-repair-august-legacy-entries-APPLY.sql` in the repo months later and runs it against a database whose rows no longer match the assumptions it was written under. Neither carries a credential — both shell scripts read DB_PASSWORD out of the prod app container at runtime — so this is about blast radius, not secrets. `scripts/deploy.sh` and `scripts/scan-for-malware.sh` are permanent tooling, already tracked, and unaffected: an ignore rule never untracks a tracked file, and the pattern is anchored to the `prod-` prefix anyway. Also ignores `*.tsbuildinfo`, a TypeScript incremental build artifact that has no business in version control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…on-on-release ci(desktop-release): auto-resolve the production version on merge to main
…scripts chore: keep one-off prod data-repair scripts out of git
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.