One of our repos was pinned to Staffbase/gha-workflows@v11.1.1, where the reusable
Update Release Draft workflow used release-drafter/release-drafter@v6.2.0 internally.
After moving the pin forward, the Update Release Draft job started failing because
our .github/release-drafter.yml configured categories[].labels as a plain string
instead of an array.
Root cause: gha-workflows v13.0.0 bumped the underlying release-drafter/release-drafter
action from v6.2.0 to v7.2.0 (a dependency update that dependabot itself flagged as
semver-major). Release-drafter v6.2.0 used a Joi schema with .single() on
categories[].labels, which auto-coerced a single string into a one item array.
Release-drafter v7.0.0 rewrote config validation using Zod, and array(string().min(1))
does not offer that coercion, so a plain string is now rejected.
The fix on our side was minimal (wrapped the string in a YAML list), so this is not
urgent. The actual ask: as far as we can tell, this behavior change was not called out
as breaking in the gha-workflows release notes for v13.0.0, it only shows up as a
generic dependency bump line. Could this be added retroactively, and could schema
altering dependency bumps like this be flagged more clearly as breaking in the future?
Affected versions:
- Before: gha-workflows v11.1.1 (release-drafter v6.2.0)
- After: gha-workflows v14.1.0 (release-drafter v7.3.0)
- Introduced in: gha-workflows v13.0.0 (release-drafter v6.2.0 to v7.2.0 bump)
One of our repos was pinned to Staffbase/gha-workflows@v11.1.1, where the reusable
Update Release Draftworkflow used release-drafter/release-drafter@v6.2.0 internally.After moving the pin forward, the
Update Release Draftjob started failing becauseour
.github/release-drafter.ymlconfiguredcategories[].labelsas a plain stringinstead of an array.
Root cause: gha-workflows v13.0.0 bumped the underlying release-drafter/release-drafter
action from v6.2.0 to v7.2.0 (a dependency update that dependabot itself flagged as
semver-major). Release-drafter v6.2.0 used a Joi schema with
.single()oncategories[].labels, which auto-coerced a single string into a one item array.Release-drafter v7.0.0 rewrote config validation using Zod, and
array(string().min(1))does not offer that coercion, so a plain string is now rejected.
The fix on our side was minimal (wrapped the string in a YAML list), so this is not
urgent. The actual ask: as far as we can tell, this behavior change was not called out
as breaking in the gha-workflows release notes for v13.0.0, it only shows up as a
generic dependency bump line. Could this be added retroactively, and could schema
altering dependency bumps like this be flagged more clearly as breaking in the future?
Affected versions: