ci: add public release finalizer#179
Open
sdaveas-circle wants to merge 14 commits into
Open
Conversation
Patch releases finalize from the release/X.Y branch itself, so the previous local `./` reference loaded build-docker.yaml from whatever branch triggered finalize-release.yaml. Pinning to @main keeps job_workflow_ref stable across patch (release/X.Y-triggered) and minor/major (main-triggered) releases, so Cloudsmith OIDC trust can anchor on a single main-pinned claim instead of a release/* wildcard.
Docker images are published manually via build-docker.yaml's workflow_dispatch trigger instead of automatically on release-PR merge. Automating this required either a Cloudsmith OIDC claim that release/* branches can't satisfy (Cloudsmith rejects wildcards) or loosening the trust condition to accept any workflow calling build-docker.yaml from any branch, which is broader than intended.
- collapse resolve_namespace() to production-only constants - remove release-namespace action input (no longer needed) - remove test-main and test-release/** branch triggers - tighten tag regex to ^v in release-binaries.yaml - simplify release_docker_image_version_from_tag to vX.Y.Z only - restore top-level concurrency in release-binaries.yaml - align actions/checkout pin to v6.0.3 across finalize-release.yaml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix git option injection: add -- before tag/branch args in git tag and
git push calls (git check-ref-format accepts --force-style names)
- Move inputs.mode out of inline bash interpolation into env var (MODE)
per GitHub Actions injection guidance
- Move write_outputs to after all git mutations in finalize mode
- Align SHORT_HASH to bash slice in manifest job (was --short=8, which
can return 9+ chars; build job already used ${SHA::8})
- Add note when Release kind is promoted from patch to minor (PATCH=0)
- Add comments documenting Copybara branch coupling and extract_body_field
single-line guarantee
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move inputs.repository-path out of inline bash interpolation into env
var (REPOSITORY_PATH) to match MODE/PR_BODY/etc pattern
- Use refs/tags/${TAG} in git rev-list to disambiguate tag from branch
if names collide (unambiguous ref path)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the public-side release finalizer automation for Arc Node:
Safety
Validation