Repository navigation
feat(release): publish release candidates as GitHub prereleases - #260
Merged
ashishkurmi merged 2 commits intoOct 24, 2026
Conversation
Add publish-prerelease.yml, which runs the full Verify Release suite and publishes a draft as a prerelease that is not marked latest, so agent-api serves it only to release-channel rc tenants. publish-release.yml now clears the prerelease flag too, so the same workflow promotes a validated candidate to latest.
ashishkurmi
approved these changes
Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a release-candidate stage to the release process, so a release can be tested on our own devices before customers get it.
publish-prerelease.yml: runs the full Verify Release suite (same gate aspublish-release.yml), then publishes the draft as a GitHub prerelease that is not marked latest. It refuses anything that is not a draft. agent-api mirrors a prerelease as a release-channel candidate and serves it only to rc tenants (step-security/agent-api#11639), so customers stay on the current release.publish-release.ymlnow also passes--prerelease=false, so the same workflow promotes the tested candidate (same tag, same bytes) to latest. No change for a draft.docs/release-process.mddocuments the new step. The full candidate-to-GA runbook with the agent-api SQS steps is in step-security/agent-api#11688 (docs/developer-mdm/release-candidates-runbook.md).Release order becomes: Release, Release macOS, Publish Prerelease, test on rc devices, Publish Release.
Why the
publish-release.ymlchange is needed: GitHub refuses to mark a prerelease as latest. Running today'sgh release edit vX.Y.Z --draft=false --lateston a prerelease fails withLatest release cannot be draft or prerelease, so a hand-flagged prerelease could never be promoted by the existing workflow.Type of change
Testing
Tested in my fork with immutable releases enabled, using the real signed assets of v1.16.0 and v1.17.0 copied from this repo, so the real verification ran end to end (signed checksums, Authenticode, notarization):
publish-release.ymlon draft v1.16.0 (run)publish-prerelease.ymlon draft v1.17.0 (run)Cannot upload assets to an immutable release,Cannot delete asset from an immutable release, tag delete 422)publish-prerelease.ymlon the published v1.16.0 (run)--draft=false --lateston the prereleaseLatest release cannot be draft or prereleasepublish-release.ymlon prerelease v1.17.0 (run)Also found: GitHub lets a published release be flipped back to prerelease even when immutable, which moves Latest back. The docs say never to do that (agent-api keeps a promoted version GA regardless).
Related Issues
Part of the DMG staged release work. agent-api side: step-security/agent-api#11639 (release channel), step-security/agent-api#11688 (runbook).