From ce71888e6749051be6117e28676c9b8d58cb527f Mon Sep 17 00:00:00 2001 From: Markus <66058642+mhovd@users.noreply.github.com> Date: Thu, 20 Aug 2026 10:40:06 +0200 Subject: [PATCH 1/3] ci: Add CI for automatic release --- .Rbuildignore | 4 ++ .github/workflows/release-please.yaml | 24 +++++++++++ .release-please-manifest.json | 3 ++ DESCRIPTION | 2 + release-please-config.json | 58 +++++++++++++++++++++++++++ 5 files changed, 91 insertions(+) create mode 100644 .github/workflows/release-please.yaml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.Rbuildignore b/.Rbuildignore index b4b32132..f32e415a 100644 --- a/.Rbuildignore +++ b/.Rbuildignore @@ -21,3 +21,7 @@ ^dev$ ^\.posit$ ^temp$ +^CHANGELOG\.md$ +^version\.txt$ +^release-please-config\.json$ +^\.release-please-manifest\.json$ diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml new file mode 100644 index 00000000..40e962ab --- /dev/null +++ b/.github/workflows/release-please.yaml @@ -0,0 +1,24 @@ +# Maintains a rolling "release PR" on main. Merging it tags the version and +# publishes a GitHub Release, which is what r-universe tracks ("branch": "*release"). +name: Release Please + +on: + push: + branches: [main] + +permissions: + contents: write + pull-requests: write + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +jobs: + release-please: + runs-on: ubuntu-latest + steps: + - uses: googleapis/release-please-action@v4 + with: + config-file: release-please-config.json + manifest-file: .release-please-manifest.json diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 00000000..d17d1ec5 --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "3.2.4" +} \ No newline at end of file diff --git a/DESCRIPTION b/DESCRIPTION index 2823d3c4..39e01190 100644 --- a/DESCRIPTION +++ b/DESCRIPTION @@ -1,7 +1,9 @@ Type: Package Package: Pmetrics Title: Pmetrics for Population Modeling and Simulation +# x-release-please-start-version Version: 3.2.4 +# x-release-please-end Authors@R: c( person("Michael", "Neely", , "mneely@usc.edu", role = c("aut", "cre")), person("Julián", "Otálvaro", , "juliandavid347@gmail.com", role = "aut"), diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 00000000..d23f0dca --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,58 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "packages": { + ".": { + "release-type": "simple", + "package-name": "Pmetrics", + "changelog-path": "CHANGELOG.md", + "extra-files": [ + { + "type": "generic", + "path": "DESCRIPTION" + } + ], + "include-component-in-tag": false, + "include-v-in-tag": true, + "changelog-sections": [ + { + "type": "feat", + "section": "Features" + }, + { + "type": "fix", + "section": "Bug Fixes" + }, + { + "type": "perf", + "section": "Performance" + }, + { + "type": "deps", + "section": "Dependencies" + }, + { + "type": "chore", + "section": "Maintenance" + }, + { + "type": "docs", + "section": "Documentation" + }, + { + "type": "refactor", + "section": "Refactoring" + }, + { + "type": "ci", + "section": "Continuous Integration", + "hidden": true + }, + { + "type": "test", + "section": "Tests", + "hidden": true + } + ] + } + } +} \ No newline at end of file From 4f051380e6172efcbe67eb0c85c7b718a2bddbca Mon Sep 17 00:00:00 2001 From: Markus <66058642+mhovd@users.noreply.github.com> Date: Thu, 20 Aug 2026 11:06:55 +0200 Subject: [PATCH 2/3] ci: Guard release-please markers and version sync att_amend_desc() in dev_history.R rewrites DESCRIPTION via desc, which strips the x-release-please marker comments. Release-please would then silently stop bumping Version, publishing a release whose DESCRIPTION reports the old one. Assert the markers exist and that DESCRIPTION matches the manifest. --- .github/workflows/R-CMD-check.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 5807bb0d..669ce247 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -90,3 +90,32 @@ jobs: error-on: '"error"' args: 'c("--no-manual", "--ignore-vignettes", "--as-cran")' build_args: 'c("--no-manual", "--no-build-vignettes")' + + version-sync: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - name: Verify release-please can still bump DESCRIPTION + shell: bash + run: | + set -euo pipefail + + # write.dcf() and desc::desc_set() silently drop comment lines, which + # would stop release-please bumping Version with no error anywhere. + for marker in '# x-release-please-start-version' '# x-release-please-end'; do + if ! grep -qxF "$marker" DESCRIPTION; then + echo "::error file=DESCRIPTION::Missing '$marker'. release-please can no longer update Version; restore the marker." + exit 1 + fi + done + + desc_version="$(sed -n 's/^Version:[[:space:]]*//p' DESCRIPTION | tr -d '[:space:]')" + manifest_version="$(jq -r '."."' .release-please-manifest.json)" + + if [ "$desc_version" != "$manifest_version" ]; then + echo "::error::DESCRIPTION Version ($desc_version) != .release-please-manifest.json ($manifest_version). These must match; release-please updates both together." + exit 1 + fi + + echo "OK: markers present, version $desc_version in sync." From 28d2809454c744746efdb76e008f6c0f26f82710 Mon Sep 17 00:00:00 2001 From: Markus <66058642+mhovd@users.noreply.github.com> Date: Thu, 20 Aug 2026 11:09:26 +0200 Subject: [PATCH 3/3] ci: Restrict GITHUB_TOKEN permissions in R-CMD-check Flagged by CodeQL on PR #378. The workflow only checks out and builds, so contents: read is sufficient. Matches pkgdown, test-coverage and release-please, which already declare explicit permissions. --- .github/workflows/R-CMD-check.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 669ce247..3b6f212b 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -8,6 +8,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }}