Copy these into a consumer repo's .github/workflows/ and adapt them. They are references, not
executed from this repo.
Replace @main with a specific commit SHA (with a # vX.Y.Z comment) and let Dependabot bump it:
uses: aragon/github-templates/.github/workflows/release-start.yml@<sha> # v0.5.0Add to the consumer's .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule: { interval: "weekly" }Every workflow takes its 1Password paths as inputs and a single OP_SERVICE_ACCOUNT_TOKEN secret
(scoped in 1Password to that repo's vault). Nothing else is inherited. See
../docs/release-design.md §4–5.
| File | Scenario | Shows |
|---|---|---|
release-changesets.yml |
A frontend / B library (single-package) | release-start + release-finalize with engine: changesets |
release-changesets-monorepo.yml |
A monorepo workspace | the same two workflows with package-dir / tag-prefix / scope / release-branch-prefix — one file per release lineage |
release-semantic-release.yml |
C backend | release-start + release-finalize with engine: semantic-release + repo-specific pre-hooks |
deploy-vercel.yml |
A / B | calling deploy-vercel behind a protected environment |
deploy-docker.yml |
C | calling deploy-docker over SSH |