ci: release safety on main — draft-first promote + per-name asset verification - #9
Merged
Conversation
verify-assets asserted only `assets | length -eq 0`, so a release that
built ONE target out of five passed the gate. That is how busbar v1.5.3
shipped five assets where seven were expected, with Apple Silicon Mac and
x86_64 Linux both 404ing for users. A count can never see a MISSING
platform; only a name can.
Ported busbar core release.yml`s contractual-filename-set approach:
* .github/release-targets.json is now the platform list, in exactly one
place. A `targets` job reads it and emits BOTH the build matrix and the
exact set of asset filenames that matrix owes the release, so the set
that is built and the set that is verified are the same computation and
cannot drift. It carries a floor so a truncated manifest cannot produce
an empty expectation list that passes vacuously.
* verify-assets now asserts every expected asset is present BY NAME and
at least 1 KiB (GitHub lists a truncated upload identically to a good
one), prints a per-asset table to the step summary, and names the
missing platforms in the failure.
* verify-assets runs on `!cancelled()`. The build matrix is
fail-fast:false, so a partial matrix FAILS the job and a `needs:` on a
failed job SKIPS its dependent by default: the one guard that exists to
notice a broken release was switched off precisely when the release was
broken.
The build matrix is byte-identical to what it was, just sourced from the
manifest. Verified locally against synthetic asset sets: complete passes;
one-platform-missing, one-of-five, truncated, zero-asset, and
right-count-wrong-name are all refused.
…rkflow ref The dev copy of this workflow called the shared verifier at @dev, a moving ref, and (in three repos) carried a torn cron -- the schedule's MM HH had been transplanted onto the bundle_image line, leaving 'cron: " * * *"' (invalid) and a bundle_image that named a time of day instead of an image. This is a clean copy for main: the original per-repo cron spread is restored so the fleet does not stampede the schedule at once, bundle_image is restored to the value the repo's artifacts actually call for, and the shared workflow is pinned to ceb7104a4cdb06f3bba20b68c6c1a76fac2215f7 -- the tip of plugin-consumer-verify.yml as of busbar v1.5.4. The v1.5.4 tag itself does not carry the file, so the commit SHA is the immutable pin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-lands ONLY the release-safety payload from
ci/draft-release-then-promote, freshly branched offmain(the old branch was stacked ondevand carried unrelated unreleased history; it will not be merged).Payload:
gh release create --draft+ promote (--draft=false --latest) only after verification passes.github/release-targets.json: the platform list in exactly one place, feeding both the build matrix and the expected-asset namesverify-assets: every expected asset present BY NAME and >= 1 KiB, running on!cancelled()Verified locally: actionlint clean; the exact embedded verifier code proven against synthetic asset sets — complete passes; one-missing, one-of-five, truncated (<1KiB), zero-asset, right-count-wrong-name, and a truncated targets manifest are all refused.