ci(release): Switch from action-prepare-release to Craft #18763

BYK · 2026-01-09T18:01:18Z

Summary

This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions.

Changes

Migrated .github/workflows/auto-release.yml to Craft reusable workflow

Documentation

See https://getsentry.github.io/craft/github-actions/ for more information.

Closes #18765 (added automatically)

This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow

github-actions · 2026-01-09T18:01:53Z

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

New Features ✨

(core) Add option to enhance the fetch error message by JPeer264 in #18466
(core,node-core) Consolidate bun and node types with ServerRuntimeOptions by JPeer264 in #18734
(nextjs) Remove tracing from generation function template by chargome in #18733
(tanstackstart-react) Add wrappers for manual instrumentation of servers-side middlewares by nicohrubec in #18680

Build / dependencies / internal 🔧

(nextjs) Split withSentryConfig by chargome in #18777

(release) Switch from action-prepare-release to Craft by BYK in #18763

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-01-09T18:06:18Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	8,981	-	8,758	+3%
GET With Sentry	1,771	20%	1,683	+5%
GET With Sentry (error only)	6,097	68%	6,037	+1%
POST Baseline	1,206	-	1,182	+2%
POST With Sentry	595	49%	576	+3%
POST With Sentry (error only)	1,059	88%	1,047	+1%
MYSQL Baseline	3,302	-	3,207	+3%
MYSQL With Sentry	489	15%	407	+20%
MYSQL With Sentry (error only)	2,674	81%	2,615	+2%

View base workflow run

The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.

.github/workflows/auto-release.yml

 on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - master
-
-# This workflow tirggers a release when merging a branch with the pattern `prepare-release/VERSION` into master.
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release (or "auto")
+        required: false
+      force:
+        description: Force a release even when there are release-blockers


.github/workflows/auto-release.yml

 on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - master
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release (or "auto")
+        required: false
+      force:
+        description: Force a release even when there are release-blockers
+        required: false
+      merge_target:


.github/workflows/release.yml

+    - name: Prepare release
+      uses: getsentry/craft@39ee616a6a58dc64797feecb145d66770492b66c # v2
+      env:
+        GITHUB_TOKEN: ${{ steps.token.outputs.token }}
+      with:
+        version: ${{ inputs.version }}
+        force: ${{ inputs.force }}
+        merge_target: ${{ inputs.merge_target }}
+        craft_config_from_merge_target: 'true'


.github/workflows/release.yml

cursor · 2026-01-10T01:20:31Z

.github/workflows/release.yml

        required: false
      merge_target:
-        description: Target branch to merge into. Uses the default branch as a fallback (optional)
+        description: Target branch to merge into


Removed default value for merge_target input

Medium Severity

The merge_target input previously had default: master but this was removed. When users trigger the release workflow without specifying a merge_target, an empty value will be passed to the Craft action via ${{ inputs.merge_target }}. In contrast, auto-release.yml explicitly passes merge_target: master. If Craft doesn't handle empty merge_target values gracefully, this could cause the release workflow to fail or behave unexpectedly.

.github/workflows/release-comment-issues.yml

.github/workflows/auto-release.yml

chargome · 2026-01-12T10:27:54Z

.github/workflows/auto-release.yml

      - name: Get auth token
        id: token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 # v2 # v1


q: Are all these version bumps actually related? The version comments are a bit confusing here

chargome · 2026-01-12T10:30:36Z

.github/workflows/release.yml

        required: false
      merge_target:
-        description: Target branch to merge into. Uses the default branch as a fallback (optional)
+        description: Target branch to merge into


q: How does craft handle this case?

chargome · 2026-01-12T10:31:58Z

.github/workflows/release.yml

  release:
-    runs-on: ubuntu-24.04
-    name: 'Release a new version'
+    runs-on: ubuntu-latest


m: I think pinning to latest would make our CI more brittle here, is this required?

.github/workflows/auto-release.yml

+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          token: ${{ steps.token.outputs.token }}
          fetch-depth: 0


.github/workflows/codeql-analysis.yml

.github/workflows/create-issue-for-unreferenced-prs.yml

ci(release): Switch from action-prepare-release to Craft

b9ae430

This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow

BYK force-pushed the ci/migrate-to-craft-action branch from f89e6b1 to b9ae430 Compare January 9, 2026 18:01

This was referenced Jan 9, 2026

ci(release): Switch from action-prepare-release to Craft #18764

Open

ci(release): Switch from action-prepare-release to Craft #18765

Open

BYK added 2 commits January 9, 2026 23:16

ci(release): Restore GitHub App token authentication

3c240d2

The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.

ci(release): Restore GitHub App token authentication

f101fbf

The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.

sentry bot reviewed Jan 9, 2026

View reviewed changes

fix: Pin actions to SHA and add permissions blocks

a8c5f38

sentry bot reviewed Jan 10, 2026

View reviewed changes

fix: Restore PR trigger and version extraction for auto-release

95d4e72

sentry bot reviewed Jan 10, 2026

View reviewed changes

cursor bot reviewed Jan 10, 2026

View reviewed changes

fix: Use correct action version SHAs (restore original versions)

f88812d

cursor bot reviewed Jan 10, 2026

View reviewed changes

.github/workflows/release-comment-issues.yml Outdated Show resolved Hide resolved

BYK added 3 commits January 10, 2026 02:07

fix: Use correct action version SHAs (restore original versions)

d17ff7e

fix: Address review feedback (inputs context, permissions, triggers)

a902463

fix: Add Node.js setup to release workflow

5348f80

cursor bot reviewed Jan 10, 2026

View reviewed changes

.github/workflows/auto-release.yml Outdated Show resolved Hide resolved

chargome reviewed Jan 12, 2026

View reviewed changes

BYK and others added 3 commits January 12, 2026 12:31

fix: Clean up action version comments

e912696

Update Craft SHA to 1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce

480fe95

Update Craft SHA to 1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce

91807f2

sentry bot reviewed Jan 13, 2026

View reviewed changes

.github/workflows/auto-release.yml Outdated

Comment on lines 26 to 29

- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

with:

token: ${{ steps.token.outputs.token }}

fetch-depth: 0

This comment was marked as outdated.

Sign in to view

BYK added 4 commits January 13, 2026 23:05

Add explicit permissions block to build.yml

fbb531f

Add explicit permissions block to codeql-analysis.yml

b4ba2d3

Add explicit permissions block to create-issue-for-unreferenced-prs.yml

e07b23e

Add explicit permissions block to enforce-license-compliance.yml

c15b599

cursor bot reviewed Jan 13, 2026

View reviewed changes

.github/workflows/codeql-analysis.yml Outdated Show resolved Hide resolved

.github/workflows/create-issue-for-unreferenced-prs.yml Outdated Show resolved Hide resolved

BYK and others added 5 commits January 13, 2026 23:15

Revert permissions changes to build.yml

e26bc72

Revert permissions changes to codeql-analysis.yml

df2832a

Revert permissions changes to create-issue-for-unreferenced-prs.yml

657b2e0

Revert permissions changes to enforce-license-compliance.yml

64e73aa

fix: revert extraneous changes to non-release workflow files

0b2d1e4

Uh oh!

ci(release): Switch from action-prepare-release to Craft #18763

Are you sure you want to change the base?

ci(release): Switch from action-prepare-release to Craft #18763

Conversation

BYK commented Jan 9, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Documentation

Uh oh!

github-actions bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

📋 Changelog Preview

New Features ✨

Build / dependencies / internal 🔧

Uh oh!

github-actions bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

node-overhead report 🧳

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot Jan 10, 2026

Choose a reason for hiding this comment

Removed default value for merge_target input

Uh oh!

Uh oh!

Uh oh!

chargome Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

chargome Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

chargome Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

BYK commented Jan 9, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Jan 9, 2026 •

edited

Loading

github-actions bot commented Jan 9, 2026 •

edited

Loading