Skip to content

ci: allow scoped maintenance releases #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MagMueller wants to merge 1 commit into from
Closed

ci: allow scoped maintenance releases #128

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,11 +67,11 @@ jobs:
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
echo "Building tag=${TAG} version=${VERSION}"

- name: Verify tag is reachable from main
# Releases must be cut from `main`. Tagging a feature branch (e.g. when
# a stacked PR has merged into a parent feature branch but not yet into
# `main`) silently produces a release whose contents diverge from the
# canonical history. Precedent: v0.0.8/v0.0.9 were tagged from
- name: Verify tag is reachable from an approved release branch
# Stable releases must be cut from `main`. A narrowly named
# `vX.Y.Z-hotfixN` prerelease may instead come from its matching
# `release/vX.Y.Z` maintenance branch. Other feature-branch tags fail
# before binaries are uploaded. Precedent: v0.0.8/v0.0.9 were tagged from
# feat/embed-lmnr-key after PR #33 merged into the feature branch
# (not into main); main moved on without it and the bcode-laminar
# package had to be re-landed in PR #39. This guard fails the release
Expand All @@ -85,15 +85,23 @@ jobs:
env:
TAG: ${{ steps.ver.outputs.tag }}
run: |
git fetch origin main --depth=1
git fetch origin main "refs/heads/release/*:refs/remotes/origin/release/*"
TAG_SHA=$(git rev-parse -q --verify "refs/tags/${TAG}^{commit}") || {
echo "::error::Tag ${TAG} does not exist locally. Create the tag on a main commit first (e.g. \`gh release create ${TAG} --target main\`), then re-run."
echo "::error::Tag ${TAG} does not exist locally. Create it on main or the matching release/vX.Y.Z maintenance branch, then re-run."
exit 1
}
if ! git merge-base --is-ancestor "$TAG_SHA" origin/main; then
echo "::error::Tag ${TAG} points at $TAG_SHA which is not reachable from origin/main. Release tags must be cut from main."
exit 1
if git merge-base --is-ancestor "$TAG_SHA" origin/main; then
exit 0
fi
if [[ "$TAG" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-hotfix[0-9]+$ ]]; then
RELEASE_REF="origin/release/v${BASH_REMATCH[1]}"
if git show-ref --verify --quiet "refs/remotes/${RELEASE_REF}" &&
git merge-base --is-ancestor "$TAG_SHA" "$RELEASE_REF"; then
exit 0
fi
fi
echo "::error::Tag ${TAG} points at $TAG_SHA outside main or its matching release/vX.Y.Z maintenance branch."
exit 1

- name: Setup Bun
uses: ./.github/actions/setup-bun
Expand Down
Loading