Repository navigation
BB-915: Release from the epic with no GitHub release - #2897
anurag4DSB wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| run: | | ||
| if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-bnaas\.[0-9]+$ ]]; then | ||
| echo "::error::$TAG is not an X.Y.Z-bnaas.N epic tag" | ||
| exit 1 |
There was a problem hiding this comment.
The check does not refuse a tag that already exists. Running 9.6.0-bnaas.1 twice overwrites the released backbeat:9.6.0-bnaas.1 and -federation images (and dashboards/policies) in build, and only then fails at tag creation. Also refuse an existing tag here, before any push.
| exit 1 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.event.inputs.tag }} | |
| run: | | |
| if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-bnaas\.[0-9]+$ ]]; then | |
| echo "::error::$TAG is not an X.Y.Z-bnaas.N epic tag" | |
| exit 1 | |
| fi | |
| if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" > /dev/null 2>&1; then | |
| echo "::error::tag $TAG already exists" | |
| exit 1 | |
| fi |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
@@ Coverage Diff @@
## epic/S3C-10971-bnaas-d1 #2897 +/- ##
===========================================================
+ Coverage 81.21% 81.25% +0.03%
===========================================================
Files 209 209
Lines 44236 44236
===========================================================
+ Hits 35928 35943 +15
+ Misses 8308 8293 -15
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
The official release workflow does not run from an epic branch, so the BNaaS D1 epic carries its own copy of it. The copy creates only the git tag, with the job token, where the original creates a GitHub release. A first check refuses a tag that is not X.Y.Z-bnaas.N, or that already exists, before any image is pushed, so neither a typo nor a rerun can overwrite a released image. Everything else stays as in development. The copy exists only on the epic, and the final merge drops it.
27e8b09 to
6b158d4
Compare
| fi | ||
| if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --silent 2>/dev/null; then | ||
| echo "::error::Tag $TAG already exists" | ||
| exit 1 |
There was a problem hiding this comment.
This check fails open: any gh api error (rate limit, 5xx, network) is read as "tag absent", so the build overwrites a released image. Treat only a 404 as absent and fail on any other error.
| exit 1 | |
| if out=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" 2>&1); then | |
| echo "::error::Tag $TAG already exists" | |
| exit 1 | |
| elif ! grep -q 'HTTP 404' <<< "$out"; then | |
| echo "::error::Cannot check tag $TAG: $out" | |
| exit 1 | |
| fi |
| - name: Refuse a tag that is not an epic tag | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| TAG: ${{ github.event.inputs.tag }} |
There was a problem hiding this comment.
Nothing checks the dispatch ref. A ticket branch cut from the epic carries this file, so a run from it can publish a -bnaas.N image and tag from an unreviewed commit. Also refuse any ref other than the epic branch, e.g. [[ "$GITHUB_REF" == refs/heads/epic/*-bnaas-d1 ]] || { echo "::error::Release only from the epic branch"; exit 1; }.
|
Closing: D1 will not release from the epic branches. Arsenal and cloudserverclient changes go through the development branches and ship in normal releases, and Federation pins the CI images of the epics by commit sha. |
Intent: why does this change exist?
The official release workflow does not run from an epic branch (cloudserverclient#31), so the D1 epic carries its own copy of it, and we release by running that copy from the epic. The copy differs from development only where the original creates a GitHub release. It is row 3.5 of the Tickets tab.
System impact: what's affected, including downstream?
Only
.github/workflows/release.yamlon the backbeat epic. A run builds backbeat:, backbeat:-federation and the dashboards and policies as in development, and Federation pins the image it needs.Preserved behavior: what explicitly stays the same?
Every other job and step stays as in development. Development keeps its own file, and the final merge drops this copy.
Intended change: what's different after this PR?
In the
releasejob, the last step creates the git tag with the job token (gh api .../git/refs) instead of creating a GitHub release. A first check refuses a tag that is notX.Y.Z-bnaas.N, or that already exists, before any image is pushed, so neither a typo nor a rerun can overwrite a released image.Verification: how do we know this worked, or how would we know if it didn't?
actionlint reports nothing new. After the merge and the version bump, one run from the epic with
9.6.0-bnaas.1must pushbackbeat:9.6.0-bnaas.1-federationand create the tag, with no GitHub release.