chore: Add release tag orchestrator workflows by smamindl · Pull Request #2540 · microsoft/SynapseML

smamindl · 2026-04-03T22:26:12Z

Summary

Automates Steps 1.4–1.5 of the SynapseML Fabric Release Guide — the ~15 manual git commands for tagging and rebasing release branches.

Two workflows

Workflow	Trigger	What it does
`release-tag.yml`	Push of `v..*` tag	Creates `python3.11` tag on master + opens PR to rebase `spark4.0`
`release-tag-spark.yml`	Rebase PR merged to `spark4.0`	Creates `spark4.0` + `python3.12` tags, cleans up branch

Flow

Engineer pushes v1.1.2 tag
       │
       ▼
  Workflow 1 runs
  ├── Creates v1.1.2-python3.11 on master ✅
  └── Opens PR: release/v1.1.2-spark4.0 → spark4.0
       │
       ▼
  Engineer reviews & merges PR (Rebase and merge)
       │
       ▼
  Workflow 2 runs
  ├── Creates v1.1.2-spark4.0 ✅
  ├── Creates v1.1.2-python3.12 ✅
  └── Cleans up release branch 🧹

Design decisions

PR-based rebase instead of force-push — provides review gate and audit trail
spark4.1 skipped (🚧 WIP) — commented out, ready to enable
Idempotent — skips tags that already exist
Conflict-safe — aborts cleanly if rebase conflicts occur

Automates Steps 1.4-1.5 of the SynapseML Fabric Release Guide: Workflow 1 (release-tag.yml): - Triggers when a primary version tag (v1.1.2) is pushed - Creates python3.11 tag on master - Opens PR to rebase spark4.0 onto master Workflow 2 (release-tag-spark.yml): - Triggers when the rebase PR is merged into spark4.0 - Creates spark4.0 and python3.12 derivative tags - Cleans up the release branch spark4.1 is skipped (WIP) until ready for release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-03T22:31:57Z

Hey @smamindl 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

fix: Fix LightGBM crashes with empty partitions
feat: Make HTTP on Spark back-offs configurable
docs: Update Spark Serving usage
build: Add codecov support
perf: improve LightGBM memory usage
refactor: make python code generation rely on classes
style: Remove nulls from CNTKModel
test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

github-actions · 2026-04-03T22:32:01Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 2e93675.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/release-tag.yml

Package	Version	License	Issue Type
actions/checkout	4..	Null	Unknown License

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/checkout

4.*.*

🟢 6

Details

Check	Score	Reason
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Security-Policy	🟢 9	security policy file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	🟢 8	SAST tool detected but not run on all commits

Scanned Files

.github/workflows/release-tag.yml

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds GitHub Actions workflows to automate release tagging and spark branch rebase orchestration per the SynapseML Fabric Release Guide (Steps 1.4–1.5).

Changes:

Adds a workflow triggered by pushing a primary vX.Y.Z tag to create a -python3.11 tag and open a rebase PR into spark4.0.
Adds a workflow triggered by merging the rebase PR to create -spark4.0 and -python3.12 tags and delete the release branch.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
.github/workflows/release-tag.yml	New workflow to react to primary version tags, mint a python tag, and open a spark rebase PR.
.github/workflows/release-tag-spark.yml	New workflow to create spark/python derivative tags after the rebase PR merge and clean up the release branch.

Copilot · 2026-04-03T22:32:54Z

+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"


GitHub Actions on.push.tags uses glob patterns, not regex. The pattern v[0-9]+.[0-9]+.[0-9]+ will not match v1.2.3 as intended. Use a glob such as v*.*.* or v[0-9]*.[0-9]*.[0-9]* (and keep the strict X.Y.Z validation in the script).

Suggested change

- "v[0-9]+.[0-9]+.[0-9]+"

- "v[0-9]*.[0-9]*.[0-9]*"

Copilot · 2026-04-03T22:32:54Z

+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "⚠️ $TAG already exists — skipping"
+          else
+            git tag "$TAG"


This step claims to create the tag "on master", but it never checks out master (the workflow is triggered from a tag ref, so HEAD will be detached at the pushed tag’s commit). As written, git tag \"$TAG\" will tag the current HEAD, which might not be master. Fix by explicitly targeting origin/master (e.g., checkout/switch to master or create the tag at the origin/master commit SHA).

Suggested change

git tag "$TAG"

git tag "$TAG" origin/master

Copilot · 2026-04-03T22:32:54Z

+          if ! git checkout spark4.0 2>/dev/null; then
+            echo "⚠️ spark4.0 branch doesn't exist — skipping"
+            exit 0
+          fi
+


git checkout spark4.0 can fail even when the remote branch exists, because a local spark4.0 branch may not exist in the runner clone. Prefer checking out explicitly from the remote (e.g., fetch and create/reset a local branch from origin/spark4.0). This makes the workflow reliable across clean runners.

Suggested change

if ! git checkout spark4.0 2>/dev/null; then

echo "⚠️ spark4.0 branch doesn't exist — skipping"

exit 0

fi

git fetch origin spark4.0

if ! git show-ref --verify --quiet refs/remotes/origin/spark4.0; then

echo "⚠️ spark4.0 branch doesn't exist — skipping"

exit 0

fi

git checkout -B spark4.0 origin/spark4.0

Copilot · 2026-04-03T22:32:55Z

+            exit 0
+          fi
+
+          git checkout -b "$BRANCH"


The workflow is described as idempotent, but reruns can fail or create duplicates: git checkout -b fails if the branch already exists, and gh pr create can error or open a second PR for the same head/base. Consider making this section rerun-safe by reusing/updating an existing branch (or skipping if it exists) and querying for an existing open PR for the same head/base before creating a new one.

Copilot · 2026-04-03T22:32:55Z

+          git push -u origin "$BRANCH"
+
+          gh pr create \
+            --base spark4.0 \
+            --head "$BRANCH" \
+            --title "chore: Rebase spark4.0 for v${VERSION} release" \


The workflow is described as idempotent, but reruns can fail or create duplicates: git checkout -b fails if the branch already exists, and gh pr create can error or open a second PR for the same head/base. Consider making this section rerun-safe by reusing/updating an existing branch (or skipping if it exists) and querying for an existing open PR for the same head/base before creating a new one.

Copilot · 2026-04-03T22:32:55Z

+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}


This checkout uses the default shallow fetch (depth 1) and may not fetch tags. That makes the later git rev-parse \"$TAG\" existence checks unreliable (it may think tags don’t exist locally), and increases the chance of push conflicts. Set fetch-depth: 0 (and ensure tags are fetched) so tag existence checks reflect the remote state.

Suggested change

token: ${{ secrets.GITHUB_TOKEN }}

token: ${{ secrets.GITHUB_TOKEN }}

fetch-depth: 0

fetch-tags: true

Copilot · 2026-04-03T22:32:55Z

+            if git rev-parse "$TAG" >/dev/null 2>&1; then
+              echo "⚠️ $TAG already exists — skipping"
+            else
+              git tag "$TAG"
+              echo "🏷️ Created $TAG"
+            fi
+          done
+
+          git push origin "$SPARK_TAG" "$PYTHON_TAG" 2>/dev/null || true
+          echo "✅ Tags pushed"


This suppresses all push failures (auth, protected refs, network) and still prints success, which can produce false positives and hidden release errors. Since you already check for existing tags, the push should fail the job on unexpected errors; only selectively ignore the specific 'already exists' case (or push each tag with explicit error handling and clear output).

Suggested change

if git rev-parse "$TAG" >/dev/null 2>&1; then

echo "⚠️ $TAG already exists — skipping"

else

git tag "$TAG"

echo "🏷️ Created $TAG"

fi

done

git push origin "$SPARK_TAG" "$PYTHON_TAG" 2>/dev/null || true

echo "✅ Tags pushed"

if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then

echo "⚠️ $TAG already exists on origin — skipping"

continue

fi

if git rev-parse "$TAG" >/dev/null 2>&1; then

echo "🏷️ $TAG already exists locally"

else

git tag "$TAG"

echo "🏷️ Created $TAG"

fi

git push origin "refs/tags/$TAG"

echo "✅ Pushed $TAG"

done

echo "✅ Tag processing complete"

Copilot AI review requested due to automatic review settings April 3, 2026 22:26

Copilot AI reviewed Apr 3, 2026

View reviewed changes

Copilot started reviewing on behalf of smamindl April 3, 2026 22:36 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Add release tag orchestrator workflows#2540

chore: Add release tag orchestrator workflows#2540
smamindl wants to merge 1 commit intomasterfrom
smamindl/release-tag-workflow

smamindl commented Apr 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 3, 2026

Uh oh!

github-actions Bot commented Apr 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

smamindl commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Two workflows

Flow

Design decisions

Related

Uh oh!

github-actions Bot commented Apr 3, 2026

Uh oh!

github-actions Bot commented Apr 3, 2026

Dependency Review

Snapshot Warnings

License Issues

.github/workflows/release-tag.yml

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

smamindl commented Apr 3, 2026 •

edited

Loading