Repository navigation
ci: replace RTagBot with release branch workflow - #822
Conversation
3e042df to
ab94dcb
Compare
renkun-ken
left a comment
renkun-ken
left a comment
There was a problem hiding this comment.
I found two cases where this can fail to publish the intended release. I exercised the workflow shell block against temporary Git repositories with a mocked gh: the fresh-tag path used the merge commit and extracted the expected notes, but an existing tag at an older commit produced a successful release for that older commit. All 18 current checks pass; they do not run the release job.
| name: Release | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
[P2] Merged release PRs from forks cannot publish with this event. The job accepts any head branch named release/<version>, including one in a fork, but GitHub gives pull_request workflows triggered from forks a read-only GITHUB_TOKEN even when contents: write is requested. Consequently the tag push (or release creation if the tag exists) fails after the PR is merged, and removing TagBot leaves no automatic release. Please use a write-capable post-merge event or otherwise handle fork-origin release PRs; if using pull_request_target, gate on the merged state and only check out the trusted merge commit. GitHub documents the fork-token restriction.
There was a problem hiding this comment.
Switched to pull_request_target: types: [closed] (gated on merged == true and checking out merge_commit_sha) in ec36929.
| in_section { print } | ||
| ' NEWS.md | sed -e '/./,$!d' -e :a -e '/^[[:space:]]*$/{$d;N;ba' -e '}' > "$NOTES_FILE" | ||
|
|
||
| if ! git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then |
There was a problem hiding this comment.
[P2] Verify that an existing tag points to the merged commit before reusing it. If v<version> was previously pushed at a different commit and has no GitHub release, this check skips creating the tag, and gh release create --verify-tag only verifies that the tag exists. The job then succeeds while publishing source archives from the old commit with notes read from the new merge commit. I reproduced this with a pre-existing tag on the parent commit. Resolve the remote tag to a commit and fail on a mismatch; still allow a matching tag for retries.
There was a problem hiding this comment.
Added remote tag target SHA verification against MERGE_SHA in ec36929.
ab94dcb to
ec36929
Compare
Summary
.github/workflows/release.yml) that tagsv<version>and publishes a GitHub release with notes fromNEWS.mdwhenever arelease/*branch PR is merged intomainormaster.release/<version>branch matchesVersion:inDESCRIPTIONat the merged commit..github/workflows/tagbot.yml).