Harden shared release tooling (sync with jetpack-crm) - #1078
Merged
Conversation
…rk guard, SHA-pin actions, pre-push hook Ports fixes from Automattic/jetpack-crm to keep the shared release scripts identical across the plugin family: - prepare-release.mjs: refuse to prepare a release from a dirty tree (git add -u would otherwise sweep unrelated tracked changes into the release commit) - prepare-release.mjs: delete the remote release branch on rollback - create-release.yml: guard the deploy job against fork-originated release/* merges - workflows: pin actions to commit SHAs (supply-chain) - .githooks/pre-push + make install-hooks: fail-fast guard against direct pushes to the default branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the shared release tooling with
Automattic/jetpack-crmso the config-driven release scripts stay identical across the plugin family. Five hardening fixes:scripts/prepare-release.mjs): a newassertCleanWorkingTree()aborts before the confirmation prompt / branch creation if the working tree has uncommitted changes to tracked files. OtherwisereplaceNextVersionPlaceholder()'sgit add -uwould sweep unrelated tracked edits into the release commit. Untracked files are excluded (no release step stages them).scripts/prepare-release.mjs):revertOnError()now also deletes the release branch on the remote if it was already pushed (e.g.createPR()failed afterpushBranch()), so a retry isn't blocked by an orphaned remote branch. Best-effort; a failed remote cleanup won't mask the original error..github/workflows/create-release.yml): thedeployjobif:now also requiresgithub.event.pull_request.head.repo.full_name == github.repository, so it only runs for same-repo (non-fork) release merges..github/workflows/create-release.yml,lint-next-version.yml): pinned the two tag-referencedactions/checkoutuses to their commit SHAs (supply-chain), keeping the original ref as a trailing comment.checkout@v6.0.3→df4cb1c…(matches jetpack-crm),checkout@v4→11d5960….setup-phpand10up/action-wordpress-plugin-deploywere already pinned.make install-hooks: adds.githooks/pre-push(blocks direct pushes totrunk; override with--no-verify) and aninstall-hooksMakefile target that setscore.hooksPath. Local-only convenience guard, not CI enforcement.Verified:
node --check scripts/prepare-release.mjspasses; both workflows are valid YAML; no unpinneduses:tags remain in the two release workflows.