Skip to content

Commit bd3db78

Browse files
printminion-coprintminion-co
committed
IONOS(ci): trigger artifactory/ghcr.io/remote-trigger jobs on per-major dev/stable branches
The 'upload-to-artifactory', 'hidirve-next-artifact-to-ghcr_io', and 'trigger-remote-dev-workflow' jobs were being silently skipped on ionos-dev-v33/ionos-stable-v33 pushes: on.push.branches already covers these branches (HDNEXT-2144), so the build itself runs, but the downstream jobs' if: conditions were never updated to match — they only checked for the bare 'ionos-dev'/'ionos-stable' names, 'rc/*', and '*/dev/*'. Port the mature whitelist-gate pattern from ionos-dev-v31: broad startsWith branch matching for the artifact jobs, plus an opt-in REMOTE_TRIGGER_NC_VERSION/REMOTE_TRIGGER_RC_BRANCH gate on the GitLab-trigger job so QA deployment can later be restricted to one NC major/RC at a time (both variables are currently unset repo-wide, so this gate is a no-op today). Scope the NC-version suffix check to ionos-dev-v*/ionos-stable-v* branches only: it was otherwise evaluated for any branch reaching that point, including rc/*, so an rc/* branch whose name happened to end with the whitelisted NC version string would incorrectly pass the gate and bypass the intended exact REMOTE_TRIGGER_RC_BRANCH whitelist match. Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
1 parent 2185d12 commit bd3db78

1 file changed

Lines changed: 70 additions & 13 deletions

File tree

‎.github/workflows/hidrive-next-build.yml‎

Lines changed: 70 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,8 @@ jobs:
128128
if [ "${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}" != "true" ]; then
129129
echo " - 💡 To enable the GitLab trigger for \`*/dev/*\` branches, set repository variable \`ENABLE_REMOTE_TRIGGER_USER_DEV\` to \`true\` at [Settings → Variables → Actions](https://github.com/${{ github.repository }}/settings/variables/actions)." >> $GITHUB_STEP_SUMMARY
130130
fi
131+
echo "**REMOTE_TRIGGER_NC_VERSION:** \`${{ vars.REMOTE_TRIGGER_NC_VERSION }}\`" >> $GITHUB_STEP_SUMMARY
132+
echo "**REMOTE_TRIGGER_RC_BRANCH:** \`${{ vars.REMOTE_TRIGGER_RC_BRANCH }}\`" >> $GITHUB_STEP_SUMMARY
131133
echo "**Event type:** \`${{ github.event_name }}\`" >> $GITHUB_STEP_SUMMARY
132134
echo "**Branch:** \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
133135
echo "" >> $GITHUB_STEP_SUMMARY
@@ -142,6 +144,8 @@ jobs:
142144
echo " set repository variable ENABLE_REMOTE_TRIGGER_USER_DEV to 'true' at:"
143145
echo " https://github.com/${{ github.repository }}/settings/variables/actions"
144146
fi
147+
echo "REMOTE_TRIGGER_NC_VERSION = '${{ vars.REMOTE_TRIGGER_NC_VERSION }}'"
148+
echo "REMOTE_TRIGGER_RC_BRANCH = '${{ vars.REMOTE_TRIGGER_RC_BRANCH }}'"
145149
echo "Event type = '${{ github.event_name }}'"
146150
echo "Branch = '${{ github.ref_name }}'"
147151
echo ""
@@ -173,11 +177,11 @@ jobs:
173177
echo " ✅ Event type is 'push'"
174178
fi
175179
176-
VALID_BRANCH_PATTERN='^(ionos-dev|ionos-stable)$|^rc/.*$|^[^/]+/dev/.*$'
180+
VALID_BRANCH_PATTERN='^(ionos-dev|ionos-stable)$|^ionos-(dev|stable)-v.*$|^rc/.*$|^[^/]+/dev/.*$'
177181
USER_DEV_PATTERN='^[^/]+/dev/.*$'
178182
if [[ ! "${{ github.ref_name }}" =~ $VALID_BRANCH_PATTERN ]]; then
179-
echo "- ❌ Branch must be 'ionos-dev', 'ionos-stable', 'rc/*' or '*/dev/*' (current: \`${{ github.ref_name }}\`)" >> $GITHUB_STEP_SUMMARY
180-
echo " ❌ Branch is '${{ github.ref_name }}' (must be 'ionos-dev', 'ionos-stable', 'rc/*' or '*/dev/*')"
183+
echo "- ❌ Branch must be 'ionos-dev', 'ionos-stable', 'ionos-dev-v*', 'ionos-stable-v*', 'rc/*' or '*/dev/*' (current: \`${{ github.ref_name }}\`)" >> $GITHUB_STEP_SUMMARY
184+
echo " ❌ Branch is '${{ github.ref_name }}' (must be 'ionos-dev', 'ionos-stable', 'ionos-dev-v*', 'ionos-stable-v*', 'rc/*' or '*/dev/*')"
181185
WILL_TRIGGER=false
182186
else
183187
echo "- ✅ Branch is '\`${{ github.ref_name }}\`'" >> $GITHUB_STEP_SUMMARY
@@ -193,6 +197,34 @@ jobs:
193197
echo " ❌ '*/dev/*' branch requires ENABLE_REMOTE_TRIGGER_USER_DEV='true' (current: '${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}')"
194198
WILL_TRIGGER=false
195199
fi
200+
else
201+
# Version gate check: bare ionos-dev/ionos-stable are always exempt; the
202+
# ionos-(dev|stable)-v* branches must end with REMOTE_TRIGGER_NC_VERSION; all other
203+
# branches reaching here (rc/*) must match REMOTE_TRIGGER_RC_BRANCH exactly — the
204+
# suffix check must NOT apply to rc/* or it could match by coincidence of name.
205+
NC_VERSION="${{ vars.REMOTE_TRIGGER_NC_VERSION }}"
206+
RC_BRANCH="${{ vars.REMOTE_TRIGGER_RC_BRANCH }}"
207+
BRANCH="${{ github.ref_name }}"
208+
209+
if [ "$BRANCH" == "ionos-dev" ] || [ "$BRANCH" == "ionos-stable" ]; then
210+
echo "- ✅ Version gate: '$BRANCH' is always exempt" >> $GITHUB_STEP_SUMMARY
211+
echo " ✅ Version gate: '$BRANCH' is always exempt"
212+
elif [ -z "$NC_VERSION" ]; then
213+
echo "- ✅ Version gate: not set — all versions allowed" >> $GITHUB_STEP_SUMMARY
214+
echo " ✅ Version gate: not set — all versions allowed"
215+
elif [[ "$BRANCH" == ionos-dev-v* || "$BRANCH" == ionos-stable-v* ]] && [[ "$BRANCH" == *"$NC_VERSION" ]]; then
216+
echo "- ✅ Version gate: branch \`$BRANCH\` matches \`$NC_VERSION\`" >> $GITHUB_STEP_SUMMARY
217+
echo " ✅ Version gate: branch '$BRANCH' matches '$NC_VERSION'"
218+
elif [ -n "$RC_BRANCH" ] && [ "$BRANCH" == "$RC_BRANCH" ]; then
219+
echo "- ✅ Version gate: branch \`$BRANCH\` matches RC whitelist \`$RC_BRANCH\`" >> $GITHUB_STEP_SUMMARY
220+
echo " ✅ Version gate: branch '$BRANCH' matches RC whitelist '$RC_BRANCH'"
221+
else
222+
echo "- ❌ Version gate: branch \`$BRANCH\` does not match version \`$NC_VERSION\` or RC branch \`$RC_BRANCH\`" >> $GITHUB_STEP_SUMMARY
223+
echo " ❌ Version gate: branch '$BRANCH' does not match version '$NC_VERSION' or RC branch '$RC_BRANCH'"
224+
echo " ℹ️ Build & image push will still run — only QA deployment is skipped"
225+
echo "- ℹ️ Build & image push will still run — only QA deployment is skipped" >> $GITHUB_STEP_SUMMARY
226+
WILL_TRIGGER=false
227+
fi
196228
fi
197229
198230
echo "- ℹ️ All dependent jobs must succeed (checked at job runtime)" >> $GITHUB_STEP_SUMMARY
@@ -692,6 +724,7 @@ jobs:
692724
always() &&
693725
(github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' ||
694726
github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' ||
727+
startsWith(github.ref_name, 'ionos-dev-') || startsWith(github.ref_name, 'ionos-stable-') ||
695728
startsWith(github.ref_name, 'rc/') || contains(github.ref_name, '/dev/')) &&
696729
needs.prepare-matrix.result == 'success' &&
697730
(needs.build-apps.result == 'success' || needs.build-apps.result == 'skipped') &&
@@ -773,15 +806,17 @@ jobs:
773806
# |------------------|------------------|------------------------------------------------------------------------------|
774807
# | Pull Request | pr | pr/hidrive-next-pr-<number>.zip |
775808
# | ionos-dev | dev | dev/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
809+
# | ionos-dev-v* | dev | dev/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
776810
# | ionos-stable | stable | stable/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
811+
# | ionos-stable-v* | stable | stable/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
777812
# | rc/* | <ref-name> | rc/<branch>/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
778813
# | */dev/* | devs/<prefix> | devs/<prefix>/hidrive-next-<ncVersion>/<shortSha>/hidrive-next-<ncVersion>.zip |
779814
780815
ARTIFACTORY_STAGE_PREFIX="dev"
781816
782817
if [ -n "${{ github.event.pull_request.number }}" ]; then
783818
ARTIFACTORY_STAGE_PREFIX="pr"
784-
elif [ "${{ github.ref_name }}" == "ionos-stable" ]; then
819+
elif [[ "${{ github.ref_name }}" == ionos-stable* ]]; then
785820
ARTIFACTORY_STAGE_PREFIX="stable"
786821
elif [[ "${{ github.ref_name }}" =~ ^rc/.*$ ]]; then
787822
ARTIFACTORY_STAGE_PREFIX="${{ github.ref_name }}"
@@ -871,6 +906,7 @@ jobs:
871906
always() &&
872907
(github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' ||
873908
github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' ||
909+
startsWith(github.ref_name, 'ionos-dev-') || startsWith(github.ref_name, 'ionos-stable-') ||
874910
startsWith(github.ref_name, 'rc/') || contains(github.ref_name, '/dev/')) &&
875911
needs.prepare-matrix.result == 'success' &&
876912
(needs.build-apps.result == 'success' || needs.build-apps.result == 'skipped') &&
@@ -928,20 +964,39 @@ jobs:
928964

929965
name: Trigger remote workflow
930966
needs: [ hidrive-next-build, upload-to-artifactory ]
931-
# Trigger remote build on "ionos-dev|ionos-stable|rc/*|*/dev/*" branch *push* defined in on:push:branches
967+
# Trigger remote build on "ionos-dev|ionos-stable|ionos-*-v*|rc/*|*/dev/*" branch *push*
968+
# defined in on:push:branches.
932969
# Can be disabled entirely via repository variable 'DISABLE_REMOTE_TRIGGER' (set to 'true' to disable)
933970
# The "*/dev/*" branch class is gated by repository variable 'ENABLE_REMOTE_TRIGGER_USER_DEV'
934971
# (default off — set to 'true' to enable once GitLab supports BUILD_TYPE=dev-<prefix>)
972+
# Version-gate: only trigger QA deployment for the whitelisted NC major version.
973+
# Set repo variable 'REMOTE_TRIGGER_NC_VERSION' to the current release version (e.g. "v33").
974+
# Applies only to 'ionos-dev-v*'/'ionos-stable-v*' branches (checked by suffix); other
975+
# branches for other versions (e.g. ionos-dev-v32) will still build & push images but
976+
# will NOT trigger the remote QA workflow. Leave unset (empty) to allow all versions.
977+
# The bare 'ionos-dev'/'ionos-stable' lanes are always exempt from this gate.
978+
# RC-gate: rc/* branches carry no version suffix and are NOT covered by the NC-version
979+
# suffix check above, so set 'REMOTE_TRIGGER_RC_BRANCH' to the exact RC branch that should
980+
# trigger QA (e.g. "rc/web-3.5"). Only one RC at a time. When promoting a new RC, update
981+
# the variable to the new branch name.
982+
# */dev/* branches bypass the version gate and are controlled solely by ENABLE_REMOTE_TRIGGER_USER_DEV.
935983
# Configure at: https://github.com/IONOS-Productivity/nc-server/settings/variables/actions
936984
if: |
937985
always() &&
938986
github.event_name == 'push' &&
939987
(github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' ||
988+
startsWith(github.ref_name, 'ionos-dev-v') || startsWith(github.ref_name, 'ionos-stable-v') ||
940989
startsWith(github.ref_name, 'rc/') ||
941990
(contains(github.ref_name, '/dev/') && vars.ENABLE_REMOTE_TRIGGER_USER_DEV == 'true')) &&
942991
needs.hidrive-next-build.result == 'success' &&
943992
needs.upload-to-artifactory.result == 'success' &&
944-
vars.DISABLE_REMOTE_TRIGGER != 'true'
993+
vars.DISABLE_REMOTE_TRIGGER != 'true' &&
994+
(contains(github.ref_name, '/dev/') ||
995+
github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' ||
996+
vars.REMOTE_TRIGGER_NC_VERSION == '' ||
997+
((startsWith(github.ref_name, 'ionos-dev-v') || startsWith(github.ref_name, 'ionos-stable-v')) &&
998+
endsWith(github.ref_name, vars.REMOTE_TRIGGER_NC_VERSION)) ||
999+
github.ref_name == vars.REMOTE_TRIGGER_RC_BRANCH)
9451000
steps:
9461001
- name: Check prerequisites
9471002
run: |
@@ -999,16 +1054,18 @@ jobs:
9991054
set -x
10001055
10011056
# Branch to GitLab Trigger Mapping (see HDNEXT-1373):
1002-
# | ref_name | GITLAB_REF | BUILD_TYPE |
1003-
# |--------------|------------|-------------------|
1004-
# | ionos-dev | main | dev |
1005-
# | ionos-stable | main | stable |
1006-
# | rc/* | main | rc |
1007-
# | */dev/* | main | dev-<branch-pfx> | (opt-in via ENABLE_REMOTE_TRIGGER_USER_DEV)
1057+
# | ref_name | GITLAB_REF | BUILD_TYPE |
1058+
# |------------------|------------|-------------------|
1059+
# | ionos-dev | main | dev |
1060+
# | ionos-dev-v* | main | dev |
1061+
# | ionos-stable | main | stable |
1062+
# | ionos-stable-v* | main | stable |
1063+
# | rc/* | main | rc |
1064+
# | */dev/* | main | dev-<branch-pfx> | (opt-in via ENABLE_REMOTE_TRIGGER_USER_DEV)
10081065
10091066
BUILD_TYPE="dev"
10101067
1011-
if [ "${{ github.ref_name }}" == "ionos-stable" ]; then
1068+
if [[ "${{ github.ref_name }}" == ionos-stable* ]]; then
10121069
BUILD_TYPE="stable"
10131070
elif [[ "${{ github.ref_name }}" =~ ^rc/ ]]; then
10141071
BUILD_TYPE="rc"

0 commit comments

Comments
 (0)