Releasing gh-actions-lock

Cutting a release

From a clean, current main, preview the next release:

RELEASE_DRY_RUN=1 script/release patch

Then cut it:

script/release patch

To preview a release candidate:

RELEASE_DRY_RUN=1 script/release patch --rc

Then cut it:

script/release patch --rc

The first candidate is vX.Y.Z-rc.1; repeating the same bump increments rc.N. Run the bump without --rc to publish the stable vX.Y.Z.

Release tags are immutable. If publishing fails, fix the publisher and run the release script again for the next RC.

Use patch for compatible fixes, minor for compatible additions, and major for breaking changes.

The script validates the repository, checks the current branch and origin/main, then pushes and verifies an annotated vX.Y.Z or vX.Y.Z-rc.N tag.

The tag workflow verifies the tag, then publishes the binaries, attestations, and GitHub release.

Dependabot compatibility

Before releasing, decide whether Dependabot's CLI integration must move with the release. Update dependabot-core when the release changes:

• CLI flags used by Dependabot.
• Findings JSON or exit codes.
• Relocking behavior.
• The lockfile schema.

Dependabot pins the CLI version and binary checksums and currently accepts lockfile schemas v0.0.2 and v0.0.3. This CLI writes v0.0.3. Add schema support there before this CLI emits a new version. Unrelated releases do not need a Dependabot bump.

The findings JSON fields can stay the same while behavior changes, which still needs this decision.