diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 23:33:16 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 23:33:16 +0300 |
| commit | 0a6d9dca9d1cb71413c9085410e28e0c4afdca3f (patch) | |
| tree | b2890295552089acb8f7c9b9bf278403be13f1c3 | |
| parent | 9e44387fa1b8fc006146b9fb774e6316101033e6 (diff) | |
| download | vyos-documentation-0a6d9dca9d1cb71413c9085410e28e0c4afdca3f.tar.gz vyos-documentation-0a6d9dca9d1cb71413c9085410e28e0c4afdca3f.zip | |
ci: harden update-version-tags against stale re-runs and silent failures
Two improvements to .github/workflows/update-version-tags.yml, bundled
because they touch the same code block:
1. HEAD-equivalence guard. GitHub's "Re-run jobs" replays the original
event SHA, which for this workflow would move tag rolling/1.5/1.4
backward to a stale commit. Compare github.sha against the live
branch HEAD via the API and exit 0 with a log line if they differ.
2. PATCH-first with 404-only fallback to POST. The previous "GET probe
then PATCH or POST" pattern silently fell through to POST on any
gh-api error (auth, rate-limit, 5xx), which would attempt to create
a tag that already exists and mask the real failure. Now the
fallback to POST fires only on HTTP 404; every other error is
re-emitted to stderr and fails the job.
Backport to circinus and sagitta after merge.
🤖 Generated by [robots](https://vyos.io)
| -rw-r--r-- | .github/workflows/update-version-tags.yml | 30 |
1 files changed, 24 insertions, 6 deletions
diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml index 35a87d61..e93f63c8 100644 --- a/.github/workflows/update-version-tags.yml +++ b/.github/workflows/update-version-tags.yml @@ -35,11 +35,29 @@ jobs: sagitta) TAG=1.4 ;; *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;; esac + + # Skip stale re-runs: GitHub's "Re-run jobs" replays the original + # event SHA, which would move the version tag backward to a stale + # commit. Compare event SHA against the current branch HEAD. + HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')" + if [ "$HEAD_SHA" != "$SHA" ]; then + echo "Skipping stale run: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA" + exit 0 + fi + echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)" - if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then - gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \ - -f sha="$SHA" -F force=true - else - gh api -X POST "repos/$REPO/git/refs" \ - -f ref="refs/tags/$TAG" -f sha="$SHA" + + # PATCH the tag if it exists; create on 404; fail loud on any other + # gh-api error (auth, rate-limit, 5xx) instead of silently falling + # through to POST. + patch_err="" + if ! patch_err="$(gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \ + -f sha="$SHA" -F force=true 2>&1)"; then + if grep -q "HTTP 404" <<<"$patch_err"; then + gh api -X POST "repos/$REPO/git/refs" \ + -f ref="refs/tags/$TAG" -f sha="$SHA" + else + echo "$patch_err" >&2 + exit 1 + fi fi |