ci: self-heal a missing GitHub Release in auto-release#11
Merged
Conversation
detect only re-released when the git tag was absent, so a transient failure that created the tag but not the GitHub Release wedged the version permanently. Split should_release into need_tag (tag absent) and need_release (tag absent OR Release absent): the tag job runs on need_tag, the release job on need_release guarded by !cancelled() plus the tag job's result, so a skipped tag still releases and a failed or cancelled one does not. The re-release must build from the tagged commit, not the moved-on main HEAD: detect resolves the tag to its immutable commit SHA and hands it to release.yml via a new optional ref input (both checkouts fall back to inputs.ref || github.sha), preserving the anti-tag-move property. gh release view runs under contents: read with GH_TOKEN; the existence check fails open, backstopped by gh release create's no-clobber default.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
auto-release'sdetectpreviously setshould_release=trueonly when the gittag was absent, so a transient CI failure that created the tag but not the
GitHub Release left the version permanently un-released — the known operational
limit noted in #9.
This splits
should_releaseintoneed_tag(tag absent) andneed_release(tagabsent or the tag's GitHub Release absent):
tagjob runs onneed_tag(so it never tries to recreate an existing tag);releasejob runs onneed_release, guarded by!cancelled()and thetagjob's result, so a skipped tag still releases (the re-release path)while a failed or cancelled one does not (a half-made tag never ships).
The re-release builds from the tagged commit, never the moved-on
mainHEAD:detectresolves the tag to its immutable commit SHA and passes it torelease.ymlvia a new optionalrefinput (both checkout steps fall back toinputs.ref || github.sha), preserving the anti-tag-move property — a resolvedcommit SHA cannot be re-pointed.
gh release viewruns under the existingcontents: readwithGH_TOKEN; the existence check fails open, backstopped bygh release create's no-clobber default.Review
Reviewed for security (token model / least privilege, injection posture,
anti-tag-move preservation, fail-open blast radius) and correctness (all four
detectoutcomes against the release guard, the empty-reffallback on bothrelease.ymlentry points, output plumbing, idempotency). No blocking findings.Assisted-by: Claude:claude-opus-4-8