Repository navigation
ci(release): refuse a Promote RC dispatch from any ref but main - #5181
Marian Koreniuk (themoriarti) wants to merge 1 commit into
Conversation
A workflow_dispatch runs the copy of promote-rc.yaml at the ref it was dispatched from. On 2026-10-16 a dispatch from release-1.6 ran that branch's older copy, one job instead of five, and had to be re-run from main. Since the release assets are signed, the same dispatch would now fail at the upload step, after the staging branch, the promotion-* candidate and the draft release already exist, and docs/release.md pins the signature identity to this workflow on main. Make the first step of parse compare github.ref with refs/heads/main and fail with an error that names main, so a dispatch from a release branch, a tag or a SHA stops before the first write. The bats test runs the step's shell under dash for main, a release branch, a tag and an empty ref, and pins the step to be the first one in parse. Assisted-by: LLM Signed-off-by: Marian Koreniuk <[email protected]>
github-actions
Bot
added
area/release
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Add and verify the dispatch ref guard .github/workflows/promote-rc.yaml, hack/promote-rc-dispatch-ref_test.bats, docs/release.md |
The parse job checks that the dispatch ref is refs/heads/main before later steps. Bats tests cover the guard’s position and behavior for main, a release branch, a tag, and an empty ref. The release instructions document the check. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Suggested labels: kind/bug, area/ci, area/release, size/S
Suggested reviewers: lexfrei
Merge Risk: 
aebef
-
The change adds a useful check that makes promotion dispatches from non-main refs fail early on current workflow copies. Older release branches or tags that still hold a pre-guard copy are not protected. This was already true before the PR. Nothing here should block merging.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: blocking Promote RC dispatches from refs other than main. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
What this PR does
Adds a first step to the
parsejob ofpromote-rc.yamlthat fails whengithub.refis notrefs/heads/main, before anything is written. This is A20 in #3278.A
workflow_dispatchruns the copy of the workflow at the dispatched ref. On 2026-10-16 a dispatch fromrelease-1.6ran that branch's older copy (one job instead of five, https://github.com/cozystack/cozystack/actions/runs/38882938797) and was re-run frommain. Since #4861 the release assets are signed, and the same dispatch would now fail at the upload step, after the staging branch, thepromotion-*candidate and the draft release already exist.docs/release.mdalso pins the signature identity to this workflow onmain, so a dispatch from another ref should stop at the front door.The step follows the shape of
Validate dispatch branchincut-prerelease.yaml: one shell comparison, an::error::that namesmain,exit 1.Test
hack/promote-rc-dispatch-ref_test.batsextracts the step'srunwithyqand executes it underdashforrefs/heads/main(passes), a release branch, a tag and an empty ref (each fails and namesmain), and pins the step to beparse's first step readinggithub.ref. It runs with the rest ofhack/*_test.batsviamake bats-unit-tests.zizmoron the workflow reports no findings.Docs
One clause in step 3 of the regular release sequence in
docs/release.md. #5169 edits the same file further down and thepromotejob of the same workflow; the hunks do not overlap.Checklist
--signoffAssisted-by: LLMtrailerhack/check-commit-trailers.sh upstream/main..HEADpassesbats hack/promote-rc-dispatch-ref_test.batsandbats hack/bats-strict-setup.batspassSummary by CodeRabbit