Repository navigation
Release daily when Go code or dependencies change - #152
Open
carole-lavillonniere wants to merge 1 commit into
Open
carole-lavillonniere wants to merge 1 commit into
carole-lavillonniere wants to merge 1 commit into
Conversation
Fixes merged right after the Friday run waited a week for a release, and Renovate held CVE fixes for 3 days unless Dependabot flagged them. Release daily instead, but only when the binaries change, and let Renovate check OSV so CVE fixes skip the release-age wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
carole-lavillonniere
marked this pull request as ready for review
November 4, 2026 13:40
carole-lavillonniere
requested review from
dfangl,
dominikschubert,
joe4dev,
nik-localstack and
pinzon
as code owners
November 4, 2026 13:40
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Speeds up getting CVE fixes into the images. Today a fix can sit for about two weeks between the upstream release and a clean image. In that time the weekly secops scan files a ticket even though the fix is already merged (AWS-2697: x/net 0.62.0 merged 10-30 at 22:15, 16h after the Friday run).
Changes
weekly-release.yml→daily-release.yml, runs at 06:00 UTC every day (localstack-pro's bump run is at 07:00). A release is cut only if commits since the last tag touchgo.mod,go.sum,*.goor theMakefile, so CI-only and docs-only commits don't cause release churn.osvVulnerabilityAlerts:vulnerabilityAlertsrelies on Dependabot alerts, which didn't fire for chore(deps): update module golang.org/x/net to v0.62.0 #150, so it waited the full 3-dayminimumReleaseAge. With OSV, fixes for known Go CVEs skip that wait and get thesecuritylabel.Expected volume
Since August, 23 days had a change of this kind, almost all Renovate. That's about 1.6 releases a week, compared to about 0.7 today, with a peak of 5 in one week. The localstack-pro bump PR updates in place, so releases made while it's open just move it forward.
Linear: COSY-1174
🤖 Generated with Claude Code