release-image: expected-commit input closes the mid-build release race - #64
Merged
Conversation
…n-flight race (#63) verify-source-commit proves the digest came from this branch's history, but the parent commit's image is in that history too — a release dispatched before the merge's build finished promoted it silently (nmon v1.14.0). The new expected-commit input makes the resolved build commit match exactly or the release fails with both SHAs named; callers whose artifact builds on every push pass their dispatch context's github.sha. Without it, a promoted build that trails the released ref now emits a run-summary warning. Also corrects the verify-source-commit doc: the matched commit is recorded in the tag message, not what the git tag points at (that changed with the workflow-file-protection workaround). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #63.
expected-commitinput: when set, the promoted digest must resolve to exactly that commit (7-40 char SHA prefix) or the release fails naming both SHAs. Requiresverify-source-commit(validated). Callers whose artifact builds on every push passgithub.shafrom the dispatch context.::warning::in the run summary — paths-filtered repos keep today's behaviour, just visibly.verify-source-commit: it names what the guard can and cannot catch, and no longer claims the git tag points at the matched commit (the tag moved to the ref with the workflow-file-protection workaround).First consumer: cshuttle/nmon's release.yml (follow-up PR there once this is tagged).
🤖 Generated with Claude Code