From 9f5a1a84f1b8cd91205a259950b870196186d81b Mon Sep 17 00:00:00 2001
From: Alfonso Noriega <alfonso.noriega@shopify.com>
Date: Wed, 15 Apr 2026 15:26:32 +0200
Subject: [PATCH] Automate patch release post-publish steps

After CI publishes a patch to npm on a stable branch, automatically:
- Create and push the git tag
- Create the GitHub Release pointing to the CHANGELOG
- Open Homebrew and docs PRs via pnpm post-release

post-release changes:
- Skip dev auth and git status checks when running in CI
- Add --skip-notification flag (patches do not send notifications)
---
 .github/workflows/release.yml | 20 ++++++++++++++++++
 bin/post-release              | 39 ++++++++++++++++++++++-------------
 2 files changed, 45 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9511bf2927..f71a1e3f1c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -116,6 +116,26 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}
 
+      - name: Create git tag and GitHub Release
+        if: steps.changesets.outputs.hasChangesets == 'false' && startsWith(github.ref_name, 'stable/')
+        run: |
+          VERSION=$(node -p "require('./packages/cli-kit/package.json').version")
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"
+          gh release create "v${VERSION}" \
+            --title "${VERSION}" \
+            --notes "See the [CHANGELOG](https://github.com/Shopify/cli/blob/${{ github.ref_name }}/packages/cli/CHANGELOG.md) for details."
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Open post-release PRs
+        if: steps.changesets.outputs.hasChangesets == 'false' && startsWith(github.ref_name, 'stable/')
+        run: pnpm post-release --skip-notification
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   # Manual/Cron release job - runs on schedule or manual trigger with tag
   manual-cron-release:
     name: Manual & Cron Release
diff --git a/bin/post-release b/bin/post-release
index d630e61538..a90d16aad3 100755
--- a/bin/post-release
+++ b/bin/post-release
@@ -1,6 +1,12 @@
 #! /usr/bin/env bash
 
-tag=$1
+# Parse flags
+skip_notification=false
+for arg in "$@"; do
+  case $arg in
+    --skip-notification) skip_notification=true ;;
+  esac
+done
 
 # Check if current branch starts with "stable"
 current_branch=$(git branch --show-current)
@@ -9,18 +15,20 @@ if [[ ! $current_branch =~ ^stable ]]; then
     exit 1
 fi
 
-# Check if git working directory is clean
-if [[ -n $(git status -s) ]]; then
-    echo "Error: Git working directory is not clean"
-    git status
-    exit 1
-fi
-
-# Check if github print-auth is working
-if ! $(/opt/dev/bin/dev github print-auth --password > /dev/null 2>&1); then
-    echo "Error: GitHub CLI authentication failed"
-    echo "Try running \`dev github print-auth\` manually"
-    exit 1
+if [[ -z "$CI" ]]; then
+  # Check if git working directory is clean
+  if [[ -n $(git status -s) ]]; then
+      echo "Error: Git working directory is not clean"
+      git status
+      exit 1
+  fi
+
+  # Check if github print-auth is working
+  if ! $(/opt/dev/bin/dev github print-auth --password > /dev/null 2>&1); then
+      echo "Error: GitHub CLI authentication failed"
+      echo "Try running \`dev github print-auth\` manually"
+      exit 1
+  fi
 fi
 
 # Create a PR to update homebrew
@@ -30,5 +38,8 @@ node ./bin/create-homebrew-pr.js
 node ./bin/create-doc-pr.js
 
 # Create a PR to add the release notification
-node ./bin/create-notification-pr.js
+# Skipped for patch releases (--skip-notification) — notifications are not sent for patches
+if [[ "$skip_notification" == "false" ]]; then
+  node ./bin/create-notification-pr.js
+fi