chore: gate release publishing behind environment#223
Conversation
posthog-dotnet Compliance ReportDate: 2026-06-07 11:31:15 UTC
|
| Test | Status | Duration |
|---|---|---|
| Request Payload.Request With Person Properties Device Id | ❌ | 43ms |
| Request Payload.Flags Request Uses V2 Query Param | ❌ | 22ms |
| Request Payload.Flags Request Hits Flags Path Not Decide | ❌ | 4ms |
| Request Payload.Flags Request Omits Authorization Header | ❌ | 4ms |
| Request Payload.Token In Flags Body Matches Init | ❌ | 5ms |
| Request Payload.Groups Round Trip | ❌ | 5ms |
| Request Payload.Groups Default To Empty Object | ❌ | 5ms |
| Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It | ❌ | 5ms |
| Request Payload.Disable Geoip False Propagates As Geoip Disable False | ❌ | 5ms |
| Request Payload.Disable Geoip Omitted Defaults To False | ❌ | 5ms |
| Request Payload.Flag Keys To Evaluate Contains Only Requested Key | ❌ | 5ms |
| Request Lifecycle.No Flags Request On Init Alone | ✅ | 4ms |
| Request Lifecycle.No Flags Request On Normal Capture | ✅ | 179ms |
| Request Lifecycle.Two Flag Calls Produce Two Remote Requests | ❌ | 7ms |
| Request Lifecycle.Mock Response Value Is Returned To Caller | ❌ | 5ms |
| Side Effect Events.Get Feature Flag Captures Feature Flag Called Event | ❌ | 5ms |
Failures
request_payload.request_with_person_properties_device_id
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.flags_request_uses_v2_query_param
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.flags_request_hits_flags_path_not_decide
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.flags_request_omits_authorization_header
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.token_in_flags_body_matches_init
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.groups_round_trip
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.groups_default_to_empty_object
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.person_properties_distinct_id_auto_populated_when_caller_omits_it
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.disable_geoip_false_propagates_as_geoip_disable_false
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.disable_geoip_omitted_defaults_to_false
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_payload.flag_keys_to_evaluate_contains_only_requested_key
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_lifecycle.two_flag_calls_produce_two_remote_requests
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
request_lifecycle.mock_response_value_is_returned_to_caller
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
side_effect_events.get_feature_flag_captures_feature_flag_called_event
404, message='Not Found', url='http://sdk-adapter:8080/get_feature_flag'
Prompt To Fix All With AIFix the following 3 code review issues. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 3
.github/workflows/release.yml:283
**`packages_released` only set inside `create_github_release_if_missing`**
`packages_released=true` is only written inside `create_github_release_if_missing`, but NuGet push, tagging, and the push to origin all happen in `release_package` before that helper is called. If the GitHub release creation is skipped because the release already exists (the early `return 0` at line 271–274), `packages_released` stays `false` even though NuGet packages were published and tags were pushed. As a result, the `notify-released` job's condition (`needs.release.outputs.packages-released == 'true'`) will never fire for the "NuGet push succeeded but GitHub release already existed" path, silently suppressing the Slack success notification.
### Issue 2 of 3
.github/workflows/release.yml:74
**Retry path bypasses `notify-approval-needed`, but the environment gate still fires**
When `has-release-commit=true` (retry scenario) and `has-changesets=false`, the `notify-approval-needed` job is skipped because its `if: needs.check-changesets.outputs.has-changesets == 'true'` condition is false. The `release` job still requires `needs: [check-changesets, notify-approval-needed]` and uses `if: always() && (...)`, so it does proceed — but no Slack approval message is sent to inform the team that an environment-gated release run is about to execute. An approver clicking "Approve" in the GitHub UI has no corresponding Slack notification to connect it to the original release context.
### Issue 3 of 3
.github/workflows/release.yml:305-307
**`git diff HEAD^ HEAD` reliability depends on `RELEASE_COMMIT` being the version-bump commit**
If the `has-release-commit` heuristic resolves a `RELEASE_COMMIT` that is not actually the version-bump commit, `HEAD^`/`HEAD` would diff across an unrelated commit boundary and `release_package` would silently skip all packages. A defensive assertion or log confirming that the resolved commit's subject matches `[version bump]` inside `release_package` would make any mis-detection explicit rather than silently skipping the release.
Reviews (1): Last reviewed commit: "chore: improve release workflow retry ha..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| run: | | ||
| git tag -a "$RELEASE_TAG" -m "$PACKAGE_NAME $RELEASE_VERSION" | ||
| git push origin "$RELEASE_TAG" | ||
| packages_released=true |
There was a problem hiding this comment.
packages_released only set inside create_github_release_if_missing
packages_released=true is only written inside create_github_release_if_missing, but NuGet push, tagging, and the push to origin all happen in release_package before that helper is called. If the GitHub release creation is skipped because the release already exists (the early return 0 at line 271–274), packages_released stays false even though NuGet packages were published and tags were pushed. As a result, the notify-released job's condition (needs.release.outputs.packages-released == 'true') will never fire for the "NuGet push succeeded but GitHub release already existed" path, silently suppressing the Slack success notification.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 283
Comment:
**`packages_released` only set inside `create_github_release_if_missing`**
`packages_released=true` is only written inside `create_github_release_if_missing`, but NuGet push, tagging, and the push to origin all happen in `release_package` before that helper is called. If the GitHub release creation is skipped because the release already exists (the early `return 0` at line 271–274), `packages_released` stays `false` even though NuGet packages were published and tags were pushed. As a result, the `notify-released` job's condition (`needs.release.outputs.packages-released == 'true'`) will never fire for the "NuGet push succeeded but GitHub release already existed" path, silently suppressing the Slack success notification.
How can I resolve this? If you propose a fix, please make it concise.| needs: [check-changesets, notify-approval-needed] | ||
| runs-on: ubuntu-latest | ||
| if: always() && needs.check-changesets.outputs.has-changesets == 'true' | ||
| if: always() && (needs.check-changesets.outputs.has-changesets == 'true' || needs.check-changesets.outputs.has-release-commit == 'true') |
There was a problem hiding this comment.
notify-approval-needed, but the environment gate still fires
When has-release-commit=true (retry scenario) and has-changesets=false, the notify-approval-needed job is skipped because its if: needs.check-changesets.outputs.has-changesets == 'true' condition is false. The release job still requires needs: [check-changesets, notify-approval-needed] and uses if: always() && (...), so it does proceed — but no Slack approval message is sent to inform the team that an environment-gated release run is about to execute. An approver clicking "Approve" in the GitHub UI has no corresponding Slack notification to connect it to the original release context.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 74
Comment:
**Retry path bypasses `notify-approval-needed`, but the environment gate still fires**
When `has-release-commit=true` (retry scenario) and `has-changesets=false`, the `notify-approval-needed` job is skipped because its `if: needs.check-changesets.outputs.has-changesets == 'true'` condition is false. The `release` job still requires `needs: [check-changesets, notify-approval-needed]` and uses `if: always() && (...)`, so it does proceed — but no Slack approval message is sent to inform the team that an environment-gated release run is about to execute. An approver clicking "Approve" in the GitHub UI has no corresponding Slack notification to connect it to the original release context.
How can I resolve this? If you propose a fix, please make it concise.| if git diff --quiet HEAD^ HEAD -- "$package_json"; then | ||
| echo "$package_name version did not change in the release commit" | ||
| return 0 |
There was a problem hiding this comment.
git diff HEAD^ HEAD reliability depends on RELEASE_COMMIT being the version-bump commit
If the has-release-commit heuristic resolves a RELEASE_COMMIT that is not actually the version-bump commit, HEAD^/HEAD would diff across an unrelated commit boundary and release_package would silently skip all packages. A defensive assertion or log confirming that the resolved commit's subject matches [version bump] inside release_package would make any mis-detection explicit rather than silently skipping the release.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 305-307
Comment:
**`git diff HEAD^ HEAD` reliability depends on `RELEASE_COMMIT` being the version-bump commit**
If the `has-release-commit` heuristic resolves a `RELEASE_COMMIT` that is not actually the version-bump commit, `HEAD^`/`HEAD` would diff across an unrelated commit boundary and `release_package` would silently skip all packages. A defensive assertion or log confirming that the resolved commit's subject matches `[version bump]` inside `release_package` would make any mis-detection explicit rather than silently skipping the release.
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
|
closing for now, investigating this next week |
1 participant
💡 Motivation and Context
Release workflows should not rely on
needs:as the only connection between an approved environment-gated job and the jobs that publish packages, push release tags, or create GitHub releases. A modified workflow could otherwise remove that dependency and run trusted release steps without the intended approval gate.This PR keeps release side effects behind the protected release environment.
💚 How did you test it?
git diff --check.origin/mainbefore opening this draft PR.📝 Checklist
If releasing new changes
pnpm changesetto generate a changeset file