ci: harden the release pipeline (stray-tag + empty-bump guards)#26
Merged
Conversation
…bumps A stray v0.5.0 tag left by a failed run caused a version-skip cascade (0.5.0 limbo on main, then 0.6.0/0.7.0 from rapid re-triggers). Add four guards to the bump job: - concurrency (group: release) so re-triggered releases queue instead of racing - a preflight that refuses an empty release (no non-release commits since the last tag) - a tag-exists check that fails fast BEFORE committing, instead of pushing main then failing on the tag - --atomic push so the release commit and tag land together or not at all fetch-depth: 0 on checkout so the preflight can read history + tags.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the
bumpjob so today's incident can't recur (strayv0.5.0tag → 0.5.0 skipped → 0.6.0/0.7.0 from rapid re-triggers).Guards added to
bumpconcurrency: { group: release, cancel-in-progress: false }— re-triggered releases queue instead of racing.v$NEWalready exists, instead of pushing the bump to main and then failing on the tag.git push --atomic— main commit and tag land together or not at all (no "main bumped but tag failed" half-state).fetch-depth: 0so the preflight can read history + tags.Not included (deliberately)
Auto-rollback on a publish failure: with the commit-back-to-main design, cleanly reverting would mean reverting a protected-main commit. Instead, after a partial failure a re-run hits the tag-exists guard and aborts loudly — safe by default. The real fix for that class is moving off commit-back-to-main (release-please/changesets), tracked separately.