ci(release): Release clients and server as Craft workspaces

.craft.yml

@@ -0,0 +1,67 @@
+minVersion: 3.3.0
+
+# Each workspace is released on its own, with its own version, tags, release
+# branch and changelog. Pick one with `--workspace <path>` or `CRAFT_WORKSPACE`.
+#
+# A workspace's changelog lists every PR that changes its directory or one of
+# its `includePaths`. Files outside all workspaces (root config, CI, docs, ...)
+# are excluded everywhere. Entries are grouped by the categories in
+# `.github/release.yml`, which all workspaces share.
+workspaces:
+  clients/python:
+    releaseBranchPrefix: release-py
+    preReleaseCommand: scripts/bump-version-py-client.sh
+    changelog:
+      policy: auto
+      scopeGrouping: false
+      unownedPaths: exclude
+    targets:
+      - name: github
+        tagPrefix: py-client@
+      - name: pypi
+      - name: sentry-pypi
+        internalPypiRepo: getsentry/pypi
+    requireNames:
+      - /.*objectstore_client.*whl$/
+      - /.*objectstore_client.*tar\.gz$/
+
+  clients/rust:
+    releaseBranchPrefix: release-rust
+    preReleaseCommand: scripts/bump-version-rs-client.sh
+    changelog:
+      policy: auto
+      scopeGrouping: false
+      unownedPaths: exclude
+    # The crates target publishes from source, so there are no build artifacts.
+    artifactProvider:
+      name: none
+    targets:
+      - name: github
+        tagPrefix: rs-client@
+      - name: crates
+
+  objectstore-server:
+    releaseBranchPrefix: release
+    preReleaseCommand: scripts/bump-version-server.sh
+    versioning:
+      policy: calver
+    changelog:
+      policy: auto
+      scopeGrouping: false
+      unownedPaths: exclude
+      # The crates the server binary is built from, plus its runtime options
+      # schema. Keep in sync with the server's path dependencies.
+      includePaths:
+        - objectstore-inventory-tracker
+        - objectstore-log
+        - objectstore-metrics
+        - objectstore-options
+        - objectstore-service
+        - objectstore-typed-options
+        - objectstore-typed-options-derive
+        - objectstore-types
+        - sentry-options
+    artifactProvider:
+      name: none
+    targets:
+      - name: github

clients/python/.github/release.yml → .github/release.yml

@@ -1,5 +1,4 @@
-# Changelog categories for this client. Keep in sync with the other client's
-# `.github/release.yml`.
+# Changelog categories for every Craft workspace in `.craft.yml`.
 #
 # A custom file replaces Craft's defaults entirely. It groups entries by change
 # type, strips the `type(scope):` prefix, and catches every remaining change so
@@ -8,6 +7,11 @@ changelog:
   exclude:
     labels:
       - skip-changelog
+    # Release commits. Releasing one workspace can touch files of another
+    # (e.g. the Rust client bumps `objectstore-types`, which the server
+    # includes), so they would otherwise show up in that changelog.
+    authors:
+      - getsentry-bot
   categories:
     - title: Breaking Changes
       commit_patterns:

.github/workflows/changelog-preview.yml

@@ -0,0 +1,116 @@
+name: Changelog Preview
+
+# Comments on the PR with the changelogs it will be listed in, one per Craft
+# workspace in `.craft.yml`, and the entry it adds to them.
+#
+# SECURITY: `pull_request_target` runs with a write token. Only the base
+# branch is checked out. The PR's commits are fetched as git objects to read
+# which files they change, but never checked out, so no PR file is read or run.
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: changelog-preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  preview:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install Craft
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CRAFT_VERSION: 3.3.0
+        run: |
+          gh release download "$CRAFT_VERSION" --repo getsentry/craft --pattern craft --dir "$RUNNER_TEMP"
+          sudo install "$RUNNER_TEMP/craft" /usr/local/bin/craft
+
+      - name: Comment changelog preview
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
+          CRAFT_LOG_LEVEL: Warn
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          GIT_AUTHOR_NAME: changelog-preview
+          GIT_AUTHOR_EMAIL: changelog-preview@localhost
+          GIT_COMMITTER_NAME: changelog-preview
+          GIT_COMMITTER_EMAIL: changelog-preview@localhost
+        run: |
+          set -euo pipefail
+
+          # Craft decides which workspaces a commit belongs to from the files it
+          # changes. Squash the PR into one commit on top of its merge base, like
+          # the merge will, and ask each workspace whether that commit is in it.
+          # `reset --soft` moves HEAD to that commit but keeps the base branch's
+          # files, so Craft reads its configuration from the base branch.
+          git fetch --quiet --no-tags origin "+refs/pull/$PR_NUMBER/head:refs/remotes/pr/head"
+          base=$(git merge-base pr/head "origin/$BASE_REF")
+          git reset --quiet --soft "$(git commit-tree "pr/head^{tree}" -p "$base" -m "#$PR_NUMBER")"
+
+          touched=()
+          impacts=()
+          entry=""
+          skipped=false
+          for workspace in $(craft workspace list | jq -r '.[]'); do
+            commits=$(CRAFT_WORKSPACE="$workspace" craft changelog --since "$base" --format json | jq '.totalCommits')
+            if [[ "$commits" == 0 ]]; then
+              continue
+            fi
+
+            result=$(CRAFT_WORKSPACE="$workspace" craft changelog --pr "$PR_NUMBER" --format json)
+            skipped=$(jq -r '.prSkipped' <<< "$result")
+            if [[ "$(jq -r '.versioningPolicy' <<< "$result")" == calver ]]; then
+              impact="CalVer"
+            else
+              case "$(jq -r '.bumpType' <<< "$result")" in
+                major) impact="🔴 Major" ;;
+                minor) impact="🟡 Minor" ;;
+                patch) impact="🟢 Patch" ;;
+                *) impact="⚪ None" ;;
+              esac
+            fi
+            touched+=("\`$workspace\`")
+            impacts+=("- \`$workspace\`: $impact")
+
+            # The entry is the same in every changelog. Craft quotes this PR's
+            # lines in the full preview; keep them and their section heading.
+            if [[ -z "$entry" ]]; then
+              entry=$(jq -r '.changelog' <<< "$result" | awk '
+                /^#+ / { heading = $0; printed = 0; next }
+                /^>/ {
+                  if (!printed && heading != "") { print heading "\n"; printed = 1 }
+                  sub(/^> ?/, ""); print
+                }')
+            fi
+          done
+
+          marker="<!-- objectstore-changelog-preview -->"
+          if [[ ${#touched[@]} -eq 0 ]]; then
+            summary="This PR doesn't change any released workspace, so it won't be listed in any changelog."
+          elif [[ "$skipped" == true ]]; then
+            summary="This PR is excluded from the changelogs of the workspaces it changes (\`skip-changelog\`): ${touched[*]}"
+          else
+            summary="This PR will be listed in the changelogs of:"$'\n\n'"$(printf '%s\n' "${impacts[@]}")"$'\n\n'"$entry"
+          fi
+          body="$marker"$'\n'"## Changelog Preview"$'\n\n'"$summary"
+
+          comment_id=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
+            --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1)
+          if [[ -n "$comment_id" ]]; then
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" -f body="$body" > /dev/null
+          elif [[ ${#touched[@]} -gt 0 ]]; then
+            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" -f body="$body" > /dev/null
+          fi
+          echo "$body" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-clients.yml → .github/workflows/release.yml

@@ -1,18 +1,19 @@
-name: Release client library
+name: Release
 
 on:
   workflow_dispatch:
     inputs:
-      client:
-        description: Client to release
+      workspace:
+        description: Craft workspace to release
         required: true
         type: choice
         options:
-          - python
-          - rust
+          - clients/python
+          - clients/rust
+          - objectstore-server
       version:
-        description: Version to release
-        required: true
+        description: Exact version, bump type (major, minor, patch), or auto. Leave blank for auto (clients) or CalVer (server)
+        required: false
       force:
         description: Force a release even when there are release-blockers (optional)
         required: false
@@ -41,11 +42,13 @@ jobs:
       - uses: astral-sh/setup-uv@5a7eac68fb9809dea845d802897dc5c723910fa3 # v7.1.3
 
       - name: Prepare release
-        uses: getsentry/action-prepare-release@3cea80dc3938c0baf5ec4ce752ecb311f8780cdc # v1.6.4
+        uses: getsentry/craft@4b763f5419255bb520e3e5a49f5b91426dcd374d # 3.3.0
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:
-          version: ${{ github.event.inputs.version }}
-          force: ${{ github.event.inputs.force }}
-          merge_target: ${{ github.event.inputs.merge_target }}
-          path: clients/${{ github.event.inputs.client }}
+          workspace: ${{ inputs.workspace }}
+          version: ${{ inputs.version }}
+          force: ${{ inputs.force }}
+          merge_target: ${{ inputs.merge_target }}
+          git_user_name: getsentry-bot
+          git_user_email: bot@sentry.io

AGENTS.md

@@ -73,7 +73,8 @@ cargo doc --workspace --all-features --no-deps --document-private-items
 
 ## Pull Requests
 
-The Python and Rust clients are released separately, each with its own changelog (`clients/python/CHANGELOG.md`, `clients/rust/CHANGELOG.md`). When making a change that touches one of the clients, consider the user-facing changelog entry, which is generated from PR titles:
+The Python client, the Rust client and the server are released separately as Craft workspaces (see `.craft.yml`), each with its own changelog (`clients/python/CHANGELOG.md`, `clients/rust/CHANGELOG.md`, `objectstore-server/CHANGELOG.md`). Changelog entries are generated from PR titles:
 
-- A PR is listed in the changelog of every client whose directory it changes, grouped by the conventional commit type of its title (`feat`, `fix`, ...). The scope doesn't matter.
-- If the title doesn't describe the change well for client users, add a `### Changelog Entry` section to the PR description with the text to use instead. It's used for every client the PR touches.
+- A PR is listed in the changelog of every workspace whose files it changes, grouped by the conventional commit type of its title (`feat`, `fix`, ...). The scope doesn't matter. The server's changelog also covers the crates it is built from (`includePaths` in `.craft.yml`); files outside all workspaces aren't listed anywhere.
+- A preview comment on the PR shows which changelogs it will be listed in.
+- If the title doesn't describe the change well for users, add a `### Changelog Entry` section to the PR description with the text to use instead. It's used for every changelog the PR is listed in.

scripts/bump-version-server.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -euxo pipefail
+
+ROOT_DIR="$(realpath $(dirname "$0")/..)"
+
+OLD_VERSION="${1}"
+NEW_VERSION="${2}"
+
+echo "Current version: $OLD_VERSION"
+echo "Bumping to version: $NEW_VERSION"
+
+cd $ROOT_DIR
+cd objectstore-server
+perl -pi -e "s/^version = \".*?\"/version = \"$NEW_VERSION\"/" Cargo.toml
+
+cd $ROOT_DIR
+cargo metadata --format-version 1 >/dev/null # update `Cargo.lock`