From d296f6c44d56a2ad14b2b22e66a9b5e790ce200b Mon Sep 17 00:00:00 2001 From: Torsten Mahr Date: Tue, 25 Aug 2026 00:28:40 +0200 Subject: [PATCH] refactor(ci): harden release follow-up jobs Follow-up to #50 with two review refinements: - update-docs pushes the changelog branch with --force-with-lease instead of --force, so a foreign commit that landed on docs/changelog-v is not silently discarded on a re-run. - post-release-validation sets GH_REPO in the step env instead of passing -R on a single call. The job has no checkout, so gh cannot infer the repository from a git remote; setting it via env covers every gh call in the step and puts the explanatory comment where the root cause is. Deliberately does not add `if: startsWith(github.ref, 'refs/tags/')` guards to publish, create-github-release or post-release-validation. The workflow has a required `tag` input on workflow_dispatch and every job checks out `${{ inputs.tag || github.ref }}`, so a dispatch is the supported way to re-run the pipeline for an existing tag. During a dispatch github.ref is refs/heads/main, so such a guard would always be false and would silently skip those jobs - exactly the re-run path that v2.0.0 needed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release.yml | 13 +++++++++---- CHANGELOG.md | 5 +++-- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 97e3eff..abcc2d6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -561,8 +561,10 @@ jobs: git add CHANGELOG.md git commit -m "docs: update changelog for v${VERSION}" - # Re-runs of the same tag reuse the branch; overwrite it instead of failing. - git push --force origin "$BRANCH" + # Re-runs of the same tag reuse the branch; overwrite it instead of + # failing, but keep --force-with-lease so a foreign commit that landed + # on the branch is not silently discarded. + git push --force-with-lease origin "$BRANCH" if [ -n "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then echo "✅ Pull request for $BRANCH already open, updated with latest changelog" @@ -597,8 +599,7 @@ jobs: echo "🔍 Validating release completion for $TAG" # Check GitHub release - # -R is required: this job has no checkout, so gh cannot infer the repo. - if gh release view "$TAG" -R "${{ github.repository }}" >/dev/null 2>&1; then + if gh release view "$TAG" >/dev/null 2>&1; then echo "✅ GitHub release exists" else echo "❌ GitHub release missing" @@ -629,6 +630,10 @@ jobs: echo "🎉 Release validation completed successfully!" env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # This job has no checkout, so `gh` cannot infer the repository from a + # git remote and reported "GitHub release missing" for a release that + # actually existed. + GH_REPO: ${{ github.repository }} - name: Notify on failure if: failure() diff --git a/CHANGELOG.md b/CHANGELOG.md index 7920802..fdbca9c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,8 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Fixed -- Release workflow: `post-release-validation` now passes `-R ` to `gh release view`, - so the check no longer fails with "GitHub release missing" in a job without a checkout. +- Release workflow: `post-release-validation` now sets `GH_REPO` for the step, so `gh` + resolves the repository in a job without a checkout instead of failing the check with + "GitHub release missing". - Release workflow: the PyPI verification uses the PyPI JSON API with retries instead of the experimental `pip index versions` plus a substring `grep`. - Release workflow: `update-docs` opens a pull request with the changelog update instead of