From b74e0a69e30bce74a9cd478c515b5d89d9482538 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Mon, 11 May 2026 00:49:57 +0300 Subject: ci: re-validate HEAD inside retag job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both Copilot and CodeRabbit flagged the same hole on PR #1958: GitHub's "Re-run failed jobs" can execute retag in isolation, skipping check_head. If the branch HEAD advanced since the original run, the isolated retag would PATCH the tag to a stale github.sha. Add the same HEAD-equivalence guard inside retag, immediately before the PATCH/POST. Defense-in-depth — both jobs check, so neither full re-runs nor selective retag re-runs can move the tag backward. 🤖 Generated by [robots](https://vyos.io) --- .github/workflows/update-version-tags.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml index a9eb463f..d6b642f4 100644 --- a/.github/workflows/update-version-tags.yml +++ b/.github/workflows/update-version-tags.yml @@ -71,6 +71,18 @@ jobs: TAG: ${{ needs.check_head.outputs.tag }} run: | set -euo pipefail + + # Re-validate HEAD inside retag too: GitHub's "Re-run failed jobs" + # can re-execute retag in isolation without re-running check_head, + # and the branch HEAD may have advanced since the original run. + # Without this guard, a re-run of just retag would PATCH the tag + # to a stale github.sha. + HEAD_SHA="$(gh api "repos/$REPO/branches/$BRANCH" --jq '.commit.sha')" + if [ "$HEAD_SHA" != "$SHA" ]; then + echo "Skipping stale retag: event SHA=$SHA, current $BRANCH HEAD=$HEAD_SHA" + exit 0 + fi + echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)" # PATCH the tag if it exists; create on 404; fail loud on any other -- cgit v1.2.3