IONOS(ci): scope the NC-version suffix gate away from rc/* branches - #324
Merged
printminion-co merged 1 commit intoAug 24, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR corrects the branch-scoping for the REMOTE_TRIGGER_NC_VERSION suffix whitelist in the Trigger remote workflow job of the HiDrive Next CI workflow, ensuring rc/* branches cannot accidentally satisfy the NC-version suffix gate by coincidence.
Changes:
- Scoped the NC-version suffix check so it only applies to
ionos-dev-v*/ionos-stable-v*branches, notrc/*. - Updated the diagnostic “Check configuration” step’s bash logic to apply the same scoping.
- Clarified inline workflow comments describing the version/RC gating behavior.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+142
to
+145
| # Version gate check: ionos-(dev|stable)-v* branches must end with | ||
| # REMOTE_TRIGGER_NC_VERSION; all other branches reaching here (rc/*) must match | ||
| # REMOTE_TRIGGER_RC_BRANCH exactly — the suffix check must NOT apply to rc/* or it | ||
| # could match by coincidence of name. |
Comment on lines
548
to
550
| # Applies only to 'ionos-dev-v*'/'ionos-stable-v*' branches (checked by suffix); other | ||
| # branches for other versions (e.g. ionos-dev-v31) will still build & push images but | ||
| # will NOT trigger the remote QA workflow. Leave unset (empty) to allow all versions. |
The version-gate suffix check (branch name endsWith REMOTE_TRIGGER_NC_VERSION) was being evaluated for any branch reaching that point, including rc/* branches. An rc/* branch whose name happens to end with the whitelisted NC version string would incorrectly pass the gate, bypassing the intended exact REMOTE_TRIGGER_RC_BRANCH whitelist match. Scope the suffix check to only apply to ionos-dev-v*/ionos-stable-v* branches. Also match the diagnostic step's dev-branch handling to the real job condition: */dev/* branches bypass the NC-version gate entirely (gated solely by ENABLE_REMOTE_TRIGGER_USER_DEV), but the diagnostic ran the version-gate check regardless and could report a false WILL BE SKIPPED for such branches. And reword the job-level version-gate comment, since the gate is scoped by branch prefix and version suffix together, not by suffix alone. Ports the fix already applied to ionos-dev-v32/v33 back to ionos-dev-v31, the branch this gate pattern was originally introduced on. Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
printminion-co
force-pushed
the
agents/trigger-artifactory-push-workflow-v31
branch
from
August 24, 2026 14:39
3697103 to
1748db4
Compare
Comment on lines
+142
to
+144
| USER_DEV_PATTERN='^[^/]+/dev/.*$' | ||
| if [[ "${{ github.ref_name }}" =~ $USER_DEV_PATTERN ]]; then | ||
| # */dev/* branches bypass the version gate entirely — they're controlled solely |
printminion-co
deleted the
agents/trigger-artifactory-push-workflow-v31
branch
August 24, 2026 14:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ionos-dev-v31— the branch this whitelist-gate pattern was originally introduced on.endsWith(ref_name, REMOTE_TRIGGER_NC_VERSION)) was being evaluated for any branch reaching that point in thetrigger-remote-dev-workflowjob'sif:condition, includingrc/*branches. Anrc/*branch whose name happens to end with the whitelisted NC version string could incorrectly pass the gate, bypassing the intended exactREMOTE_TRIGGER_RC_BRANCHmatch.ionos-dev-v*/ionos-stable-v*branches, both in the real jobif:condition and in the informational diagnostic step's bash logic.REMOTE_TRIGGER_NC_VERSION/REMOTE_TRIGGER_RC_BRANCHare currently unset repo-wide, so this bug is currently dormant — this is a correctness/future-proofing fix, not a behavior change today.Test plan
python3 -c "import yaml; yaml.safe_load(open('.github/workflows/hidrive-next-build.yml'))"— YAML is validionos-dev-v32/ionos-dev-v33(PR IONOS(ci): trigger artifactory/ghcr.io/remote-trigger jobs on per-major dev/stable branches #322, IONOS(ci): trigger artifactory/ghcr.io/remote-trigger jobs on per-major dev/stable branches #323) for consistencyionos-dev-v31thatTrigger remote workflowbehavior is unchanged forionos-dev-v31/rc/*/*/dev/*branches