Skip to content

chore: update release.yml#3921

Open
hf-security-analysis[bot] wants to merge 1 commit intomainfrom
security-fix/-github-workflows-release-yml-1773327883
Open

chore: update release.yml#3921
hf-security-analysis[bot] wants to merge 1 commit intomainfrom
security-fix/-github-workflows-release-yml-1773327883

Conversation

@hf-security-analysis
Copy link

@hf-security-analysis hf-security-analysis bot commented Mar 12, 2026

Update .github/workflows/release.yml workflow configuration.

cc @Wauplin @hanouticelina

Closes huggingface/tracking-issues#19


Note

Medium Risk
Changes affect the release automation pipeline; removing jobs and truncating the workflow could break GitHub release creation and other post-release steps unless intentionally retired.

Overview
The release.yml workflow is simplified: the version detection step now receives release_type/version_override via env instead of setting them inside the script.

It also removes the latter half of the release pipeline, dropping jobs that created/updated GitHub releases and AI-generated notes, ran downstream RC testing branches, opened the post-release version bump PR, and synced HF CLI skill docs. The file is left truncated mid-comment and missing a trailing newline.

Written by Cursor Bugbot for commit ee09503. This will update automatically on new commits. Configure here.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

labels: |
automated
cli-sync
# notes using the AI script and create a No newline at end of file
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Truncated comment left behind after job deletion

Low Severity

The file ends with a dangling, truncated comment block (lines 317–323). The release-notes job and subsequent jobs were removed, but the comment header describing the "RELEASE NOTES" strategy was only partially deleted — the last line cuts off mid-sentence at "create a". This orphaned comment references removed functionality and is incomplete, appearing to be an editing artifact from the deletion.

Fix in Cursor Fix in Web

@bot-ci-comment
Copy link

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

@Wauplin
Copy link
Contributor

Wauplin commented Mar 12, 2026

Let's try to find a different solution 😬

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant