Fix publish pipeline: fail loudly for non-dev releases, add workflow_dispatch, improve status table

Copilot · phlax · web-flow · commit 5396a12eae77 · 2026-06-30T21:14:31.000Z
Co-authored-by: phlax &lt;454682+phlax@users.noreply.github.com&gt;
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
@@ -5,6 +5,7 @@ on:
     branches:
     - main
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
@@ -8,6 +8,7 @@ on:
   push:
     branches:
     - main
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -7,6 +7,7 @@ on:
   pull_request:
     branches:
     - main
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/py.yml b/.github/workflows/py.yml
@@ -7,6 +7,7 @@ on:
   pull_request:
     branches:
     - "main"
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
@@ -7,6 +7,7 @@ on:
   pull_request:
     branches:
     - main
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/actions/github/afterall/tests/all-success.test.yml b/actions/github/afterall/tests/all-success.test.yml
@@ -0,0 +1,31 @@
+uses: ./actions/github/afterall
+id: afterall
+with:
+  sha: abc1234
+  repo: owner/repo
+  workflows: |
+    Workflow A
+    Workflow B
+
+before:
+- shell: bash
+  run: |
+    cat > "${ACTION_TEST_PATH}/mock_runs.json" <<'EOF'
+    {
+      "workflow_runs": [
+        {"name": "Workflow A", "id": 1, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"},
+        {"name": "Workflow B", "id": 2, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"}
+      ]
+    }
+    EOF
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    OUTPUT='%{{ steps.afterall.outputs.status }}'
+    test_continue "$OUTPUT" "true"
+    test_status_has "$OUTPUT" "Workflow A" "conclusion" "success"
+    test_status_has "$OUTPUT" "Workflow B" "conclusion" "success"
diff --git a/actions/github/afterall/tests/failed-workflow.test.yml b/actions/github/afterall/tests/failed-workflow.test.yml
@@ -0,0 +1,31 @@
+uses: ./actions/github/afterall
+id: afterall
+with:
+  sha: abc1234
+  repo: owner/repo
+  workflows: |
+    Workflow A
+    Workflow B
+
+before:
+- shell: bash
+  run: |
+    cat > "${ACTION_TEST_PATH}/mock_runs.json" <<'EOF'
+    {
+      "workflow_runs": [
+        {"name": "Workflow A", "id": 1, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"},
+        {"name": "Workflow B", "id": 2, "status": "completed",
+         "conclusion": "failure", "created_at": "2024-01-01T00:00:00Z"}
+      ]
+    }
+    EOF
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    OUTPUT='%{{ steps.afterall.outputs.status }}'
+    test_continue "$OUTPUT" "false"
+    test_status_has "$OUTPUT" "Workflow A" "conclusion" "success"
+    test_status_has "$OUTPUT" "Workflow B" "conclusion" "failure"
diff --git a/actions/github/afterall/tests/in-progress.test.yml b/actions/github/afterall/tests/in-progress.test.yml
@@ -0,0 +1,31 @@
+uses: ./actions/github/afterall
+id: afterall
+with:
+  sha: abc1234
+  repo: owner/repo
+  workflows: |
+    Workflow A
+    Workflow B
+
+before:
+- shell: bash
+  run: |
+    cat > "${ACTION_TEST_PATH}/mock_runs.json" <<'EOF'
+    {
+      "workflow_runs": [
+        {"name": "Workflow A", "id": 1, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"},
+        {"name": "Workflow B", "id": 2, "status": "in_progress",
+         "conclusion": null, "created_at": "2024-01-01T00:00:00Z"}
+      ]
+    }
+    EOF
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    OUTPUT='%{{ steps.afterall.outputs.status }}'
+    test_continue "$OUTPUT" "false"
+    test_status_has "$OUTPUT" "Workflow A" "conclusion" "success"
+    test_status_has "$OUTPUT" "Workflow B" "status" "in_progress"
diff --git a/actions/github/afterall/tests/missing-workflow.test.yml b/actions/github/afterall/tests/missing-workflow.test.yml
@@ -0,0 +1,29 @@
+uses: ./actions/github/afterall
+id: afterall
+with:
+  sha: abc1234
+  repo: owner/repo
+  workflows: |
+    Workflow A
+    Workflow B
+
+before:
+- shell: bash
+  run: |
+    cat > "${ACTION_TEST_PATH}/mock_runs.json" <<'EOF'
+    {
+      "workflow_runs": [
+        {"name": "Workflow A", "id": 1, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"}
+      ]
+    }
+    EOF
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    OUTPUT='%{{ steps.afterall.outputs.status }}'
+    test_continue "$OUTPUT" "false"
+    test_status_has "$OUTPUT" "Workflow A" "conclusion" "success"
+    test_status_missing "$OUTPUT" "Workflow B"
diff --git a/actions/github/afterall/tests/mocks/gh b/actions/github/afterall/tests/mocks/gh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Mock gh command for testing github/afterall action
+# Returns configured mock workflow run data for API calls
+
+set -e
+
+MOCK_LOG="${MOCK_LOG:-/tmp/gh-mock.log}"
+MOCK_RUNS="${ACTION_TEST_PATH}/mock_runs.json"
+
+print_cmd() {
+    local arg
+    for arg in "$@"; do
+        if [[ "$arg" =~ [[:space:]] ]]; then
+            printf '"%s" ' "$arg"
+        else
+            printf '%s ' "$arg"
+        fi
+    done | sed 's/ $//'
+    echo
+}
+
+print_cmd gh "$@" >> "$MOCK_LOG"
+
+command="$1"
+case "$command" in
+    api)
+        shift
+        JQ_FILTER=""
+        while [[ $# -gt 0 ]]; do
+            case "$1" in
+                --jq) JQ_FILTER="$2"; shift 2 ;;
+                *) shift ;;
+            esac
+        done
+        if [[ -n "$JQ_FILTER" ]]; then
+            jq -c "$JQ_FILTER" "$MOCK_RUNS"
+        else
+            cat "$MOCK_RUNS"
+        fi
+        ;;
+    workflow)
+        # Swallow workflow dispatch calls silently in tests
+        exit 0
+        ;;
+    *)
+        echo "Unknown gh command: $command" >&2
+        exit 1
+        ;;
+esac
diff --git a/actions/github/afterall/tests/test_fun.sh b/actions/github/afterall/tests/test_fun.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+
+test_continue () {
+    local output="$1"
+    local expected="$2"
+    local got
+    got=$(echo "$output" | jq -r '.continue')
+    if [[ "$got" != "$expected" ]]; then
+        echo "fail:Expected continue='$expected', got '$got'" >> "$TEST_OUTPUT"
+        return
+    fi
+    echo "success:continue=$got" >> "$TEST_OUTPUT"
+}
+
+test_status_has () {
+    local output="$1"
+    local workflow="$2"
+    local field="$3"
+    local expected="$4"
+    local got
+    got=$(echo "$output" | jq -r --arg w "$workflow" --arg f "$field" \
+        '.status | fromjson | .[$w][$f]')
+    if [[ "$got" != "$expected" ]]; then
+        echo "fail:Expected status[$workflow][$field]='$expected', got '$got'" >> "$TEST_OUTPUT"
+        return
+    fi
+    echo "success:status[$workflow][$field]=$got" >> "$TEST_OUTPUT"
+}
+
+test_status_missing () {
+    local output="$1"
+    local workflow="$2"
+    local present
+    present=$(echo "$output" | jq -r --arg w "$workflow" \
+        '.status | fromjson | has($w)')
+    if [[ "$present" != "false" ]]; then
+        echo "fail:Expected workflow '$workflow' to be absent from status, got present=$present" \
+            >> "$TEST_OUTPUT"
+        return
+    fi
+    echo "success:workflow '$workflow' correctly absent from status" >> "$TEST_OUTPUT"
+}
diff --git a/actions/github/release/action.yml b/actions/github/release/action.yml
@@ -84,6 +84,7 @@ runs:
       sha: ${{ inputs.sha }}
       title: >-
         ${{ inputs.title }}
+      token: ${{ inputs.token || github.token }}
       version: ${{ inputs.version }}
       version-file: ${{ inputs.version-file }}
       workflows: ${{ inputs.workflows }}
diff --git a/actions/github/release/status/action.yml b/actions/github/release/status/action.yml
@@ -18,6 +18,10 @@ inputs:
 
       ### \(.title)
 
+  token:
+    type: string
+    default: ${{ github.token }}
+    description: GitHub token used to dispatch missing workflows (best-effort)
   version:
     type: string
     default:
@@ -123,7 +127,66 @@ runs:
                 | {key: "[\($wf) (#\($st.id))](https://github.com/\($repo)/actions/runs/\($st.id))",
                    value: "`\($st.status)`/`\($conclusion)`"}
               else
-                {key: $wf, value: "-"}
+                {key: $wf, value: "🚫 missing"}
               end
           )
         | from_entries
+  - name: Fail if non-dev release cannot proceed
+    if: >-
+      ! fromJSON(steps.afterall.outputs.continue)
+      && ! fromJSON(steps.version.outputs.version).is_dev
+    shell: bash
+    env:
+      GH_TOKEN: ${{ inputs.token }}
+      AFTERALL_STATUS: ${{ steps.afterall.outputs.status }}
+      WORKFLOWS: ${{ inputs.workflows }}
+      REPOSITORY: ${{ inputs.repository }}
+      SHA: ${{ inputs.sha }}
+      RELEASE_NAME: ${{ inputs.name }}
+      VERSION_JSON: ${{ steps.version.outputs.version }}
+    run: |
+      WF_STATUS_OBJ=$(echo "$AFTERALL_STATUS" | jq -r '.status | fromjson')
+      VERSION=$(echo "$VERSION_JSON" | jq -r '.version')
+      SHORT_SHA="${SHA:0:8}"
+
+      MISSING=()
+      PROBLEMS=()
+
+      while IFS= read -r wf; do
+        [[ -z "$wf" ]] && continue
+        if echo "$WF_STATUS_OBJ" | jq -e --arg n "$wf" '.[$n]' > /dev/null 2>&1; then
+          WF_RUN=$(echo "$WF_STATUS_OBJ" | jq -r --arg n "$wf" '.[$n]')
+          WF_STATUS=$(echo "$WF_RUN" | jq -r '.status')
+          WF_CONCLUSION=$(echo "$WF_RUN" | jq -r '.conclusion // empty')
+          if [[ "$WF_STATUS" != "completed" ]]; then
+            PROBLEMS+=("$wf ($WF_STATUS)")
+          elif [[ "$WF_CONCLUSION" != "success" ]]; then
+            PROBLEMS+=("$wf ($WF_CONCLUSION)")
+          fi
+        else
+          MISSING+=("$wf")
+          PROBLEMS+=("$wf (no run found)")
+        fi
+      done <<< "$WORKFLOWS"
+
+      # Dispatch missing workflows — best-effort so the next publish event
+      # can auto-recover once the dispatched runs complete.
+      for wf in "${MISSING[@]}"; do
+        echo "::notice::Attempting to dispatch missing workflow '$wf' for repo $REPOSITORY ref main"
+        if gh workflow run "$wf" --ref main --repo "$REPOSITORY"; then
+          echo "::notice::Dispatched workflow '$wf' — publish will retry when it completes"
+        else
+          echo "::warning::Could not dispatch workflow '$wf'" \
+            "(token may lack workflow:write, or no workflow_dispatch trigger)" \
+            "— manual retry required"
+        fi
+      done
+
+      DETAIL="${PROBLEMS[*]}"
+      # Join with ', ' using parameter expansion
+      DETAIL=$(printf '%s, ' "${PROBLEMS[@]}")
+      DETAIL="${DETAIL%, }"
+      MSG="Cannot publish non-dev release ${RELEASE_NAME}-v${VERSION}"
+      MSG+=" for ${SHORT_SHA}: required workflow(s) missing or unsuccessful: ${DETAIL}"
+      echo "::error::${MSG}"
+      exit 1
diff --git a/actions/github/release/status/tests/dev-skip.test.yml b/actions/github/release/status/tests/dev-skip.test.yml
@@ -0,0 +1,35 @@
+uses: ./actions/github/release/status
+id: status
+with:
+  name: docker
+  sha: abc1234def567890
+  title: "Test commit"
+  version-file: /tmp/test-version.txt
+  repository: owner/repo
+  workflows: |
+    Workflow A
+    Workflow B
+
+before:
+- shell: bash
+  run: |
+    echo "1.0.0-dev" > /tmp/test-version.txt
+    cat > "${ACTION_TEST_PATH}/mock_runs.json" <<'EOF'
+    {
+      "workflow_runs": [
+        {"name": "Workflow A", "id": 1, "status": "completed",
+         "conclusion": "success", "created_at": "2024-01-01T00:00:00Z"}
+      ]
+    }
+    EOF
+
+after:
+- shell: bash
+  run: |
+    . "${ACTION_TEST_PATH}/test_fun.sh"
+    # Dev version with continue=false must NOT fail — silent skip is correct
+    CONTINUE='%{{ steps.status.outputs.continue }}'
+    VERSION='%{{ steps.status.outputs.version }}'
+    test_continue "{\"continue\": \"$CONTINUE\"}" "false"
+    test_is_dev "$VERSION" "true"
+    echo "success:Dev version with continue=false did not fail the step" >> "$TEST_OUTPUT"
diff --git a/actions/github/release/status/tests/mocks/gh b/actions/github/release/status/tests/mocks/gh
diff --git a/actions/github/release/status/tests/test_fun.sh b/actions/github/release/status/tests/test_fun.sh
