Problem
build-release.yml creates both releases with gh release create and no --target: the pre-release at line 407 and the draft stable release at line 502. GitHub then records target_commitish: main, a branch name, not the commit the run built and tested. halos-org/skip's releases show this: the draft v1.5.0+1 and the pre-release v1.5.0+1_pre both have target=main.
A release tag is created against the target when the release is published:
- Draft stable release. The tag appears only when someone publishes the draft, on whatever
main points to at that moment. "Delete previous draft releases" runs only in build-and-release, which needs the test job to succeed. So if a later merge's tests fail, the older draft stays. Publishing it then tags the later, untested commit.
- Pre-release. The tag is created when the step runs, on
main's head at that time. If another merge lands while the run is testing, the _pre tag points past the built commit.
For .deb repositories the attached package came from the right commit, so a misplaced tag mostly misleads. For repositories with build-deb: false and no registry publish, the tag is the release. halos-org/docs-tools is one: consumers install it by pinning git+https://github.com/halos-org/docs-tools@vX.Y.Z+N. There a misplaced tag ships code that CI never tested.
Proposed change
Pass --target "$GITHUB_SHA" to both gh release create calls so each tag points at the commit the run tested. Check that publishing a draft with an explicit SHA target creates the tag on that SHA even after main has moved on.
Found while reviewing halos-org/docs-tools#31.
Problem
build-release.ymlcreates both releases withgh release createand no--target: the pre-release at line 407 and the draft stable release at line 502. GitHub then recordstarget_commitish: main, a branch name, not the commit the run built and tested. halos-org/skip's releases show this: the draftv1.5.0+1and the pre-releasev1.5.0+1_preboth havetarget=main.A release tag is created against the target when the release is published:
mainpoints to at that moment. "Delete previous draft releases" runs only inbuild-and-release, which needs thetestjob to succeed. So if a later merge's tests fail, the older draft stays. Publishing it then tags the later, untested commit.main's head at that time. If another merge lands while the run is testing, the_pretag points past the built commit.For
.debrepositories the attached package came from the right commit, so a misplaced tag mostly misleads. For repositories withbuild-deb: falseand no registry publish, the tag is the release. halos-org/docs-tools is one: consumers install it by pinninggit+https://github.com/halos-org/docs-tools@vX.Y.Z+N. There a misplaced tag ships code that CI never tested.Proposed change
Pass
--target "$GITHUB_SHA"to bothgh release createcalls so each tag points at the commit the run tested. Check that publishing a draft with an explicit SHA target creates the tag on that SHA even aftermainhas moved on.Found while reviewing halos-org/docs-tools#31.