releasegate

Overview ¶

Command releasegate is the weekly release gate. It lists everything that must block a weekly release.

Run it from the v3 module: `go run ./tasks/releasegate`.

Exit codes: 0 = clean (or overridden), 1 = blockers found, 2 = could not evaluate. The gate FAILS CLOSED: an API it cannot read is never treated as "clean".

What blocks

1. open issues/PRs labelled P0 or release-blocker
2. open issues labelled regression created since the last weekly
3. open Dependabot / code-scanning alerts of critical|high severity and any open secret-scanning alert - only if the alert touches SHIPPED code
4. repository security advisories still in "triage"

TRUST RULE: a label counts only if its most recent `labeled` event (with no later `unlabeled`) was made by an allowlisted actor, so random users cannot block or unblock a release. The `high-priority` label is deliberately NOT used: .github/issue-labeler.yml applies it automatically from issue text.

Token scopes (use WAILS_REPO_TOKEN; the default GITHUB_TOKEN cannot read these):

fine-grained PAT / GitHub App on wailsapp/wails with read access to:
  Issues, Pull requests, Metadata, Administration (collaborator permission),
  Dependabot alerts, Code scanning alerts, Secret scanning alerts,
  Repository security advisories (Security advisories), and
  organisation Members (read) for the team-membership check;
  plus Issues: write ONLY if STATUS_ISSUE is set (to post the status comment).
classic PAT equivalent: repo, read:org, security_events.

Environment (an empty value means the default)

GH_TOKEN              API token (falls back to GITHUB_TOKEN)
GITHUB_API_URL        API base URL (default https://api.github.com)
REPO                  default wailsapp/wails
ALLOW_TEAM            org/team slug allowlist source        (default wailsapp/maintainers)
ALLOW_COLLAB_PERMS    collaborator permissions that count   (default "maintain admin")
SHIPPED_ALERT_IGNORE  OWNER REVIEW: regex of paths that are NOT shipped code;
                      alerts located only there are ignored
LAST_WEEKLY_DATE      ISO date of the last v3.Y.0 tag (default: derived from git)
STATUS_ISSUE          number of the single "Weekly release status" issue (optional)
OVERRIDE_REASON       non-empty => report blockers but exit 0
REPORT_FILE           markdown report path (default release-gate-report.md)
BLOCKER_LABELS        space-separated labels that block     (default "P0 release-blocker")
REGRESSION_LABEL      regression label                      (default regression)
GITHUB_ACTOR          recorded with an override             (default unknown)
GITHUB_STEP_SUMMARY   if set, the report is appended to it