From 8ddb9f35c0d6f0f5f73a20b425eb1bf147e21b3a Mon Sep 17 00:00:00 2001 From: Chaithanya Balakavi Date: Fri, 15 May 2026 13:40:46 +0000 Subject: [PATCH] Tag combined release at sub-release build commit for reproducibility - Update combine-release workflow to tag the combined release at the same commit as the first sub-release (build commit), instead of HEAD. - Ensures the combined release tag matches the code state used to build the images, improving traceability and reproducibility. - Sets target_commitish for the combined release using the commit SHA from the first grouped release tag. - Aligns with industry best practices for release packaging. --- .github/workflows/combine-release.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/combine-release.yml b/.github/workflows/combine-release.yml index 3decbe1..7ae18be 100644 --- a/.github/workflows/combine-release.yml +++ b/.github/workflows/combine-release.yml @@ -41,6 +41,13 @@ jobs: RELEASE_VERSION: ${{ github.event.inputs.release_version }} GROUPED_RELEASE_TAGS: ${{ github.event.inputs.grouped_release_tags }} + - name: Get commit of first sub-release tag + id: get_commit + run: | + FIRST_TAG=$(echo "${{ github.event.inputs.grouped_release_tags }}" | cut -d',' -f1 | xargs) + COMMIT=$(git rev-list -n 1 "$FIRST_TAG") + echo "commit_sha=$COMMIT" >> "$GITHUB_OUTPUT" + - name: Upload combined release notes uses: actions/upload-artifact@v4 with: @@ -56,5 +63,6 @@ jobs: draft: false prerelease: ${{ github.event.inputs.release_type == 'prerelease' }} token: ${{ secrets.RELEASE_PUSH_TOKEN != '' && secrets.RELEASE_PUSH_TOKEN || github.token }} + target_commitish: ${{ steps.get_commit.outputs.commit_sha }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}