Repository navigation
CLDSRV-1027: Release from the epic, no GitHub release - #6339
Closed
anurag4DSB wants to merge 1 commit into
Closed
anurag4DSB wants to merge 1 commit into
anurag4DSB wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-bnaas\.[0-9]+$ ]]; then | ||
| echo "::error::$TAG is not an X.Y.Z-bnaas.N epic tag" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
This check doesn't catch a tag that already exists. Re-running with an existing epic tag (or using "Re-run all jobs") rebuilds and overwrites all the <tag> images, and only then fails at "Create the tag". Fail early if the tag exists, before any push:
Suggested change
| fi | |
| fi | |
| if git ls-remote --exit-code --tags "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$TAG" >/dev/null; then | |
| echo "::error::tag $TAG already exists" | |
| exit 1 | |
| fi |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## epic/S3C-10971-bnaas-d1 #6339 +/- ##
========================================================
Coverage 87.87% 87.87%
========================================================
Files 206 206
Lines 14193 14193
========================================================
Hits 12472 12472
Misses 1721 1721
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
The official release workflow does not run from an epic branch, so the BNaaS D1 epic carries its own copy of it. The copy creates only the git tag, with the job token, where the original creates a GitHub release. A first check refuses a tag that is not X.Y.Z-bnaas.N, or that already exists, before any image is pushed, so neither a typo nor a rerun can overwrite a released image. It also builds scality-kms:<tag>-federation itself instead of starting a scality-kms release, which would create a GitHub release in scality-kms. The image holds the proprietary SafeNet library and this repository is public, so the clone keeps no token and the build log stays quiet. The push needs the Write role for scality/cloudserver on the scality-kms package. The GitHub App token is limited to reading scality-kms. Everything else stays as in development. The copy exists only on the epic, and the final merge drops it.
anurag4DSB
force-pushed
the
improvement/CLDSRV-1027-epic-release-workflow
branch
from
October 22, 2026 16:40
b713fbd to
e4fb5c9
Compare
Contributor
Author
|
Closing: D1 will not release from the epic branches. Arsenal and cloudserverclient changes go through the development branches and ship in normal releases, and Federation pins the CI images of the epics by commit sha. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent: why does this change exist?
The official release workflow does not run from an epic branch (cloudserverclient#31), so the D1 epic carries its own copy of it, and we release by running that copy from the epic. The copy differs from development only where the original creates a GitHub release. It is row 3.3 (and 3.3a) of the Tickets tab.
System impact: what's affected, including downstream?
Only
.github/workflows/release.yamlon the CloudServer epic. A run builds the CloudServer images as in development, plusscality-kms:<tag>-federation; Federation pins both federation images throughcloudserver_image_version. The scality-kms push needs a one-time grant, the Write role forscality/cloudserverin the scality-kms package settings, which also lets other cloudserver workflows write that package until the final merge removes it.Preserved behavior: what explicitly stays the same?
Every other job and step stays as in development. Development keeps its own file, and the final merge drops this copy.
Intended change: what's different after this PR?
In the
releasejob, the last step creates the git tag with the job token (gh api .../git/refs) instead of creating a GitHub release. A first check refuses a tag that is notX.Y.Z-bnaas.N, or that already exists, before any image is pushed, so neither a typo nor a rerun can overwrite a released image. The GitHub App token is limited to reading scality-kms. Thetrigger-kms-releasejob builds scality-kms itself instead of starting a scality-kms release, which would create a GitHub release in scality-kms; because this repository is public, the clone keeps no token and the build log stays quiet. This replaces cloudserver#6338.Verification: how do we know this worked, or how would we know if it didn't?
actionlint reports nothing new. The scality-kms build currently fails on Node 24 for every CloudServer 9.5+ base, official releases included (the
ioctlmodule), so the first epic run waits for that fix in scality-kms and for the package grant. If the scality-kms job fails after the tag exists, use "Re-run failed jobs": "Re-run all jobs" stops at the first check, because the tag already exists.