fix(release): recover publication convergence#260
Conversation
Deploying podnotes with
|
| Latest commit: |
1460563
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://85edc311.podnotes.pages.dev |
| Branch Preview URL: | https://fix-release-publication-reco.podnotes.pages.dev |
0d54f23 to
1460563
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 146056329f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const trustedMasterRecovery = | ||
| sourceRef === 'refs/heads/master' && | ||
| process.env.EVENT_SHA === master.data.object.sha; |
There was a problem hiding this comment.
When this new master-recovery path is used (workflow_dispatch --ref master for an older release), the attestation is issued from the master run context, but the publish job still verifies with --source-ref "$SOURCE_REF" and --source-digest "$EXPECTED_SHA" where EXPECTED_SHA is the older release commit. The gh attestation verify flags enforce the source repository digest/ref (per the CLI manual: --source-digest enforces the source repository digest and --source-ref enforces the git ref), so no attestation created by a master run can satisfy source-digest=releaseSha, blocking the advertised recovery before publishing.
Useful? React with 👍 / 👎.
1 participant
Summary
untagged-*draft after verifying its target, metadata, asset names, sizes, and downloaded SHA-256 digestsFailure reproduced
Release run 29079058001 built and tested commit 79c6421, registered tag 2.17.4, attested both assets, uploaded them, and verified their remote digests. The immediate publish response appeared stale, so the old rollback converted the release into an
untagged-*draft.Validation
git diff --checknpm run format:checknpm run lintnpm run typechecknpm run test -- scripts/release-contract.test.ts scripts/release-plan.test.ts(28 tests).github/workflows/release.ymlRecovery
After this PR is reviewed and merged, dispatch
release.ymlfrom protected master for PR #259. The workflow will reclaim only the exact machine-generated orphan draft from the failed run, reverify and re-upload the exact release assets, publish after state convergence, then verify the public tag, downloaded asset hashes, attestations, and recovery-branch cleanup.