Repository navigation
ci: keep the major version tag pointing at the latest release - #17
Merged
Merged
Conversation
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Secrets |  0  0  0  0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
|
guydanko-orca
approved these changes
Nov 8, 2026
guydanko-orca
left a comment
guydanko-orca
left a comment
There was a problem hiding this comment.
LGTM. Matches the workflow merged in orcasecurity/shiftleft-sast-action#26.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The floating
v1tag is what this repo's README tells users to pin to, but nothing moves it — it has to be done by hand after each release.In orcasecurity/shiftleft-sast-action that step was missed on four consecutive releases and
v1sat on a February build for nine months, until a customer noticed their workflows were not picking up fixes. This repo is currently in sync (v1->11731c5b= v1.0.6, Sep 2026), so this is preventative, not a fix.Same fix as orcasecurity/shiftleft-sast-action#26.
Change
Adds
.github/workflows/update-major-tag.yml, which re-points the major tag at the newest release:release: released— movesv1to the publishedvMAJOR.MINOR.PATCHtag automatically.releaseddoes not fire for pre-releases, so a pre-release can never movev1.workflow_dispatch— moves it on demand; optionaltaginput, falls back to the latest release. Passing an older tag rollsv1back.Guards: a concurrency group so two releases published close together can't race on the force-push; tags that aren't
vMAJOR.MINOR.PATCHare skipped with a warning; the major is derived from the release tag, so a futurev2works unchanged.The tag stays annotated. Needs
contents: write. The only action used isactions/checkout, pinned to the same SHA already used by this repo's other workflows.Verification
YAML parses and the tag-resolution logic was exercised locally. The workflow itself has not been executed —
workflow_dispatchonly appears once the file is on the default branch, and thereleasepath needs a real release. After merging, run it once manually from the Actions tab: it will be a no-op on content, but it provescontents: writeis sufficient and that no tag ruleset blocks the force-push.Caveat
If a ruleset is ever added over
refs/tags/v*, this push will fail unless the ruleset grants the workflow a bypass. There's a comment in the file to make that easy to trace.