Skip to content

Publish a release

Which component you need depends on what you're releasing. Read Explanation: release automation for the shared reasoning; this page is the setup steps per ecosystem.

Go / Conventional-Commits projects → releaser-pleaser

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      token: $RELEASER_PLEASER_TOKEN
      branch: main
      stage: release
  - component: gitlab.com/phpboyscout/cicd/[email protected]
  1. Create the token. $RELEASER_PLEASER_TOKEN needs api + write_repository scope — a project or group access token, not $CI_JOB_TOKEN (a job-token-pushed tag doesn't fire downstream tag pipelines, so goreleaser would never run). Store it as a project CI/CD variable, Masked + Protected.
  2. Use Conventional Commits on every merge to your default branch. releaser-pleaser derives the next version and changelog from them.
  3. Merge normally. On each push to main, releaser-pleaser opens or updates a Release MR with the computed version bump and generated changelog.
  4. Review and merge the Release MR. Merging it cuts the vX.Y.Z tag — that's what triggers goreleaser to build and publish the release binaries.

Rust crates → release-plz

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
  1. Create two tokens: $RELEASE_PLZ_TOKEN (api + write_repository, same constraint as above — not $CI_JOB_TOKEN) and $CARGO_REGISTRY_TOKEN (your crates.io API token, for cargo publish). Both Masked + Protected CI/CD variables.
  2. Use Conventional Commits. Same as above — release-plz derives versions and per-crate changelogs from them.
  3. Merge normally. release-plz:pr opens/updates the Release MR on every push to the default branch.
  4. Review and merge the Release MR. release-plz:release then publishes every crate (in dependency order) and cuts the tag + GitLab release.

Terraform / OpenTofu modules → tofu-module-publish

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      module_name: bootstrap
      module_system: aws

This one doesn't drive a Release MR at all — it publishes whatever tag you cut, by hand or via another tool, to the GitLab Terraform Module Registry. No token setup needed for the common case: the default token ($CI_JOB_TOKEN) has write access to your own project's package registry, even on GitLab Free.

Once published, consumers reference your module by registry address instead of a git:: tag ref:

module "bootstrap" {
  source  = "gitlab.com/<your-namespace>/bootstrap/aws"
  version = "1.2.3"
}

Using more than one at a time

A repo can combine these where it makes sense — e.g. a project publishing both a Go binary (releaser-pleaser + goreleaser) and a Terraform module (tofu-module-publish) from the same tag pipeline runs all three components together; they don't conflict.

See also