diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 23:56:03 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-05-10 23:56:03 +0300 |
| commit | be0085e6697de97de71a8d35855afb13309514f5 (patch) | |
| tree | 530bcda3f1ffedaf048835334a1faa992879b52f /.github/workflows | |
| parent | a8ce2ce4fc519013c0bbda9d5424ca526eb4bf12 (diff) | |
| parent | 878ea77e4bb891f8de026edc5a4444436e054add (diff) | |
| download | vyos-documentation-be0085e6697de97de71a8d35855afb13309514f5.tar.gz vyos-documentation-be0085e6697de97de71a8d35855afb13309514f5.zip | |
Merge pull request #1953 from vyos/yuriy/harden-update-version-tags
ci: harden update-version-tags against stale re-runs and silent failures
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/update-version-tags.yml | 35 |
1 files changed, 28 insertions, 7 deletions
diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml index 35a87d61..04ccd1e4 100644 --- a/.github/workflows/update-version-tags.yml +++ b/.github/workflows/update-version-tags.yml @@ -14,7 +14,10 @@ permissions: contents: write concurrency: - group: version-tag-${{ github.ref_name }} + # Include github.sha so a stale "Re-run jobs" replay (which carries the + # original SHA) cannot cancel an in-progress run for the current branch + # HEAD. Same-SHA re-runs still deduplicate. + group: version-tag-${{ github.ref_name }}-${{ github.sha }} cancel-in-progress: true jobs: @@ -35,11 +38,29 @@ jobs: sagitta) TAG=1.4 ;; *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;; esac + + # Skip stale re-runs: GitHub's "Re-run jobs" replays the original + # event SHA, which would move the version tag backward to a stale + # commit. Compare event SHA against the current branch HEAD. + HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')" + if [ "$HEAD_SHA" != "$SHA" ]; then + echo "Skipping stale run: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA" + exit 0 + fi + echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)" - if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then - gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \ - -f sha="$SHA" -F force=true - else - gh api -X POST "repos/$REPO/git/refs" \ - -f ref="refs/tags/$TAG" -f sha="$SHA" + + # PATCH the tag if it exists; create on 404; fail loud on any other + # gh-api error (auth, rate-limit, 5xx) instead of silently falling + # through to POST. + patch_err="" + if ! patch_err="$(gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \ + -f sha="$SHA" -F force=true 2>&1)"; then + if grep -q "HTTP 404" <<<"$patch_err"; then + gh api -X POST "repos/$REPO/git/refs" \ + -f ref="refs/tags/$TAG" -f sha="$SHA" + else + echo "$patch_err" >&2 + exit 1 + fi fi |