From 6ac9e9f05537d81786d2aa914554bff18f9464ae Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Mon, 14 Sep 2026 16:59:14 +0200
Subject: [PATCH] Publish verified OTel spike agent images

The merge test in StackVista/stackstate#561 requires the collector provenance labels present only on STAC-25490-otel-spike. That branch currently has no push-triggered builds, and workflow_dispatch skips image publication.

Enable the three existing CI workflows on that exact spike branch. Preserve the same-commit cross-workflow verification barriers and existing per-architecture image build, scan and signing jobs.

Keep DEB publication and the shared pre-release install script restricted to stackstate-7.78.2. Permit the spike multi-architecture manifest after successful image publication with package publication intentionally skipped; retain the package-success prerequisite for the release branch. Never proceed after failed or cancelled image publication.

Validation: offline Zizmor has no findings; 525 local publication guard cases pass. Parsed workflow comparison confirms only the intended triggers and guards changed.
---
 .github/workflows/build-binaries.yml      |  1 +
 .github/workflows/build-deb.yml           | 14 ++++++++++----
 .github/workflows/lint-and-unit-tests.yml |  1 +
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index d995d4f2a76f..aa3bf826cad5 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - stackstate-7.78.2
+      - STAC-25490-otel-spike
   schedule:
     - cron: "17 20 * * 1-5"
   workflow_dispatch:
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 825037edee99..9b85a450f8ef 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - stackstate-7.78.2
+      - STAC-25490-otel-spike
   schedule:
     - cron: "17 20 * * 1-5"
   workflow_dispatch:
@@ -427,7 +428,12 @@ jobs:
 
   merge-agent-manifest:
     name: Publish and sign multi-architecture agent image
-    if: github.event_name == 'push'
+    if: >-
+      !cancelled() && github.event_name == 'push'
+      && needs.publish-agent-image.result == 'success'
+      && (needs.sign-and-publish-deb.result == 'success'
+          || (github.ref == 'refs/heads/STAC-25490-otel-spike'
+              && needs.sign-and-publish-deb.result == 'skipped'))
     needs:
       - publish-agent-image
       - sign-and-publish-deb
@@ -461,7 +467,7 @@ jobs:
       - await-verification
       - build-deb
       - test-deb-renaming
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/stackstate-7.78.2'
     runs-on: ubuntu-24.04
     environment: agent-pre-release
     timeout-minutes: 30
@@ -518,7 +524,7 @@ jobs:
   generate-install-script:
     name: Generate the pre-release agent install script
     needs: godeps-cache-amd64
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/stackstate-7.78.2'
     runs-on: xlarge-public
     timeout-minutes: 30
     permissions:
@@ -564,7 +570,7 @@ jobs:
     needs:
       - generate-install-script
       - sign-and-publish-deb
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/stackstate-7.78.2'
     runs-on: ubuntu-24.04
     environment: agent-pre-release
     timeout-minutes: 15
diff --git a/.github/workflows/lint-and-unit-tests.yml b/.github/workflows/lint-and-unit-tests.yml
index 52d7a41b0fc2..2a7ba46f70c3 100644
--- a/.github/workflows/lint-and-unit-tests.yml
+++ b/.github/workflows/lint-and-unit-tests.yml
@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - stackstate-7.78.2
+      - STAC-25490-otel-spike
   workflow_dispatch:
 
 permissions: