Skip to content

ci: make server release retries tag-idempotent - #94

Merged
Vonng merged 2 commits into
mainfrom
codex/release-idempotency
Aug 29, 2026
Merged

ci: make server release retries tag-idempotent#94
Vonng merged 2 commits into
mainfrom
codex/release-idempotency

Conversation

@Vonng

@Vonng Vonng commented Aug 29, 2026

Copy link
Copy Markdown
Member

Summary

  • serialize Server Release and finalize jobs by resolved tag
  • verify tag/HEAD/OIDC identity and pin GoReleaser to the tag
  • replace exactly one unfinalized Draft from scratch
  • refuse published, duplicate, inaccessible, or finalized Draft state
  • protect GPG-derived package SBOM/checksum/attestation assets with a finalize marker

Validation

  • fail-closed release-state fixtures
  • actionlint v1.7.12 across all workflows
  • GoReleaser config validation
  • combined candidate workflow and provenance checks

The Docker lane already requires a published latest release and retains its global latest serialization. A controlled Draft/retry exercise remains a pre-publication gate. This PR does not create a tag or run any release workflow.

Vonng added 2 commits August 29, 2026 17:25
Serialize release and finalize work by tag, replace only one unfinalized Draft, refuse published or finalized release state, and pin GoReleaser to the checked-out tag. Add fail-closed release-state fixtures to the release pipeline.

Signed-off-by: Feng Ruohang <rh@vonng.com>
@Vonng
Vonng merged commit 5f44fe3 into main Aug 29, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant