Repository navigation
ci(release): backport build provenance and release failure fixes to v2.x - #7507
Merged
Merged
Conversation
Adds a build provenance attestation for every GitHub Release asset, created in the `publish` job right before the release is made immutable. - `actions/attest` signs the versioned tarballs, zips, deb/rpm/apk packages, `checksums.txt` and the `install` script. The unversioned `supabase_<os>_<arch>.tar.gz` aliases are byte-identical copies, so the same attestations cover them by digest. - `attestations: write` is granted to the `publish` job and to both callers of `release-shared.yml` (`release.yml` and `release-smoke-test.yml`), since a reusable workflow cannot exceed its caller's permissions. Anyone can now verify a downloaded asset with `gh attestation verify <file> --repo supabase/cli`. Once a release ships with attestations, the aqua registry entry for `supabase/cli` can add `github_artifact_attestations` with `signer_workflow: supabase/cli/.github/workflows/release-shared.yml`, which makes mise and aqua verify each download against it. This touches release infrastructure, so it needs a cherry-pick to `v2.x`. (cherry picked from commit 96eab1d)
Backports the parts of #7465 that apply to a maintenance line: - the platform-package wait in publish.ts polls for up to 30 minutes and the publish job timeout is 60 minutes - backfill-release-notes drops other channels' prerelease tags and rebuilds one channel note per tagged commit from tag names, and forces the release type implied by the tag's own version so a forced maintenance version still gets release notes The next-ahead gate, the in-flight stable release wait, the setup-cli v3 smoke test changes and the next channel docs are left out: v2.x has no next channel, its release.yml only runs as a maintenance dispatch, and its setup-cli smoke test covers v1 and v2 only. (cherry picked from commit 497bf42)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
Both independent reviews completed with zero findings. My additional inspection of the diff, surrounding release code, and trusted conventions found no actionable issues. All 63 release-channel unit tests passed; backfill E2E and npm polling tests were not run.
Findings
No issues found.
Stats
Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picks #7467 and #7465 onto
v2.x, as the maintenance line needs both before its next release.attestations: writeis granted to thepublishjob and to therelease.ymlandrelease-smoke-test.ymlcallers. The smoke test conflicted, so the permission goes in its top-level block.publishjob timeout.backfill-release-notesdrops other channels' prerelease tags, rebuilds one channel note per tagged commit from tag names, and forces the release type implied by the tag's own version so a forced maintenance version still gets notes.v2.x's script is plain async, so those changes are ported by hand rather than merged.Left out of #7465 because
v2.xhas nonextchannel and itsrelease.ymlonly runs as a maintenance dispatch: thenext-aheadgate, the in-flight stable release wait, the setup-cli v3 smoke test changes (v2.xcovers v1 and v2 only, sowait-for-npm-version.shwould be unused) and the matching docs.propose-release-notes.ymlalready requests noissues: read, so there is nothing to remove.