feat: add Release Punter workflow by Copilot · Pull Request #23694 · github/gh-aw

Copilot · 2026-03-31T12:18:15Z

Summary

Adds a new standard GitHub Actions workflow (.github/workflows/update-stable-release.yml) named Release Punter to update the stable alias in .github/aw/releases.json.

Changes

`.github/workflows/update-stable-release.yml` (new file)

A workflow_dispatch-triggered workflow named "Release Punter" with the following behaviour:

Feature	Detail
Input	Optional `version` (e.g. `v1.2.3`). Omit to use the latest published release.
Fork guard	Skips entirely when the workflow runs on a fork (`!github.event.repository.fork`)
Permission check	Validates the triggering actor has `admin` or `maintain` role via `GET /repos/{owner}/{repo}/collaborators/{actor}/permission` → `role_name`
Version resolution	If no `version` is given, resolves to `github.rest.repos.getLatestRelease`
Release validation	Verifies the version matches `vMAJOR.MINOR.PATCH`, exists as a published (non-draft) GitHub release, and warns if it is flagged as pre-release
Update	Sets `.aliases.stable` in `.github/aw/releases.json` using `jq`
JSON validation	Validates `releases.json` is still valid JSON after the `jq` update before committing
Idempotent	Skips the commit/push if the stable alias is already at the requested version
Commit	Committed as `github-actions[bot]` with message `chore: update stable release to vX.Y.Z`
Concurrency	`cancel-in-progress: false` prevents two simultaneous runs from producing conflicting commits
Injection-safe	All `${{ }}` expression expansions are bound to `env:` variables and accessed via `process.env.*` (JS) or `$VAR` (shell)

The default path (no version input) moves stable to the latest release; providing an older version enables easy rollback.

✨ PR Review Safe Output Test - Run 23797519571

💥 [THE END] — Illustrated by Smoke Claude · ◷

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/34c8400f-ce29-4429-a454-b91614f2473f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-03-31T12:19:51Z

@copilot name it "Release Punter"

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/796051fd-b3b7-46dd-87bf-884bfff4414e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-31T12:24:39Z

@copilot name it "Release Punter"

Done in 06fc209 — both the workflow name: and job name: are now "Release Punter".

pelikhan · 2026-03-31T12:28:58Z

@copilot move inline variable expansions to env var references to avoid shell injection

…nt shell injection Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d184af5e-c5bf-4c67-841a-0b13f898be1e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-31T12:34:57Z

@copilot move inline variable expansions to env var references to avoid shell injection

Done in 19a81d0. All three injection points are now safe:

inputs.version → env: INPUT_VERSION read as process.env.INPUT_VERSION in JS
steps.version.outputs.version in the validate step → env: RELEASE_VERSION read as process.env.RELEASE_VERSION in JS
steps.version.outputs.version in both shell steps → env: VERSION referenced as $VERSION

pelikhan · 2026-03-31T12:38:07Z

.github/workflows/update-stable-release.yml

+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit and push


@copilot add a JSON validation of releases.json to ensure it wasn't broken

Done in ea29e78 — added a "Validate releases.json" step between the update and the commit. It runs jq empty on the file and fails the workflow if the JSON is invalid, preventing a corrupt file from being committed.

Copilot

Pull request overview

Adds a manually triggered GitHub Actions workflow (“Release Punter”) to update the stable alias in .github/aw/releases.json, with guardrails around who can run it and what release tags are allowed.

Changes:

Introduces a workflow_dispatch workflow that resolves a target version (explicit input or latest release).
Validates the triggering actor’s repo role and validates the target tag corresponds to a published (non-draft) release.
Updates .aliases.stable in .github/aw/releases.json and commits/pushes the change only when necessary.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-31T12:40:48Z

.github/workflows/update-stable-release.yml

+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+


workflow_dispatch can be run against any branch/ref in the UI. With the default actions/checkout behavior and a plain git push, this workflow will modify and push to whichever ref was selected when dispatching (including feature branches), rather than reliably updating the repository’s default branch.

Consider explicitly checking out github.event.repository.default_branch (or failing early when github.ref is not the default branch) and pushing to that branch to ensure stable is always updated in the intended place.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fffd70fe-9740-4577-a96e-044a9248c748 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-03-31T12:45:43Z

.github/workflows/update-stable-release.yml

+  update-stable:
+    name: Release Punter
+    runs-on: ubuntu-latest
+    # Never run on forks — they cannot push to the upstream repository


The fork guard is a good safety measure! Consider also adding a check that github.ref == refs/heads/main (or refs/heads/$\{\{ github.event.repository.default_branch }}) so this workflow only updates stable from the default branch, preventing accidental stable alias updates from feature branches dispatched in the UI.

github-actions · 2026-03-31T12:45:43Z

.github/workflows/update-stable-release.yml

+              });
+              version = release.tag_name;
+              core.info(`ℹ️ No version specified, resolved to latest: ${version}`);
+            }


The pre-release warning via core.warning is good UX. Consider also surfacing this in the step summary (core.summary.addRaw(...)) so it's visible in the Actions UI without having to dig into logs — enterprise users monitoring releases will appreciate the extra visibility.

feat: add update-stable-release workflow

fd4d17a

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/34c8400f-ce29-4429-a454-b91614f2473f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Mar 31, 2026

Copilot created this pull request from a session on behalf of pelikhan March 31, 2026 12:19 View session

Copilot finished work on behalf of pelikhan March 31, 2026 12:19

Copilot AI requested a review from pelikhan March 31, 2026 12:19

Copilot started work on behalf of pelikhan March 31, 2026 12:20 View session

feat: rename workflow to Release Punter

06fc209

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/796051fd-b3b7-46dd-87bf-884bfff4414e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~feat: add update-stable-release workflow~~ feat: add Release Punter workflow Mar 31, 2026

Copilot finished work on behalf of pelikhan March 31, 2026 12:25

Copilot started work on behalf of pelikhan March 31, 2026 12:29 View session

fix: move inline expression expansions to env var references to preve…

19a81d0

…nt shell injection Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d184af5e-c5bf-4c67-841a-0b13f898be1e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan March 31, 2026 12:35

pelikhan marked this pull request as ready for review March 31, 2026 12:37

Copilot AI review requested due to automatic review settings March 31, 2026 12:37

pelikhan reviewed Mar 31, 2026

View reviewed changes

Copilot started work on behalf of pelikhan March 31, 2026 12:38 View session

Copilot started reviewing on behalf of pelikhan March 31, 2026 12:38 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

fix: add JSON validation of releases.json after update

ea29e78

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fffd70fe-9740-4577-a96e-044a9248c748 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan March 31, 2026 12:44

Copilot AI requested a review from pelikhan March 31, 2026 12:44

github-actions bot mentioned this pull request Mar 31, 2026

Smoke Test: Claude - 23797519571 #23698

Closed

github-actions bot reviewed Mar 31, 2026

View reviewed changes

pelikhan merged commit 9c095ed into main Mar 31, 2026

pelikhan deleted the copilot/create-action-workflow-update-stable-release branch March 31, 2026 12:50

pull bot pushed a commit to Stars1233/gh-aw that referenced this pull request Mar 31, 2026

feat: add Release Punter workflow (github#23694)

795b3ed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add Release Punter workflow#23694

feat: add Release Punter workflow#23694
pelikhan merged 4 commits intomainfrom
copilot/create-action-workflow-update-stable-release

Copilot AI commented Mar 31, 2026 •

edited by github-actions bot

Loading

Uh oh!

pelikhan commented Mar 31, 2026

Uh oh!

Copilot AI commented Mar 31, 2026

Uh oh!

pelikhan commented Mar 31, 2026

Uh oh!

Copilot AI commented Mar 31, 2026

Uh oh!

pelikhan Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

github-actions bot left a comment

Uh oh!

github-actions bot Mar 31, 2026

Uh oh!

github-actions bot Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		- name: Checkout repository
		uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Conversation

Copilot AI commented Mar 31, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

.github/workflows/update-stable-release.yml (new file)

Uh oh!

pelikhan commented Mar 31, 2026

Uh oh!

Copilot AI commented Mar 31, 2026

Uh oh!

pelikhan commented Mar 31, 2026

Uh oh!

Copilot AI commented Mar 31, 2026

Uh oh!

pelikhan Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 31, 2026 •

edited by github-actions bot

Loading

`.github/workflows/update-stable-release.yml` (new file)