From 7607469e3aacfc3295e8d7d15df4c392344de281 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 19 Aug 2026 14:01:38 +0000 Subject: [PATCH] fix: release workflow failing with "fatal: not in a git directory" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two real, unrelated bugs surfaced by the first real trigger — neither is about the RELEASE_PUSH_TOKEN/PAT despite the failure looking auth-shaped: 1. The container job's checkout registers the checked-out path as a git safe.directory, but that doesn't reliably carry over to later plain run: steps executing inside a job-level container: (devkitpro/ devkitarm here) — they can fail on git ops the checkout step itself just did fine seconds earlier. Fixed with an explicit `git config --global --add safe.directory '*'` step right after checkout, in the same execution context later steps use. 2. The version-format check used bash's `[[ ... =~ ... ]]`, but this step's shell is POSIX sh (dash), not bash — `[[` doesn't exist there, and a failing `if` *condition* doesn't trigger `sh -e`, so the check was silently skipped rather than failing, letting "2.4" through instead of requiring "2.4.0". Rewritten with grep -Eq (already used elsewhere in this script) and verified against real dash. --- .github/workflows/release.yml | 21 ++++++++++++++++++++- CHANGELOG.md | 24 ++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 280991a..aae14ac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,6 +43,17 @@ jobs: with: token: ${{ secrets.RELEASE_PUSH_TOKEN || github.token }} + # actions/checkout's own `set-safe-directory: true` registers the + # checkout path as a git safe.directory, but for a job that runs in a + # custom `container:` (like this one), that registration doesn't + # reliably carry over to later plain `run:` steps executing inside + # that container — they can fail on git operations with errors like + # "fatal: not in a git directory" even though the checkout itself + # worked fine moments earlier. Re-registering it here, in the same + # execution context later steps use, is the standard fix. + - name: Configure git safe.directory for the container job + run: git config --global --add safe.directory '*' + # Validates the typed-in version input, then cuts CHANGELOG.md's # "## Unreleased" section into a dated "## vX.Y.Z" one (leaving a # fresh empty "## Unreleased" above it) and bumps source/types.h's @@ -52,11 +63,19 @@ jobs: # than the current VERSION_STRING, or the changelog has nothing new # to release, since a bad input at this point would otherwise commit # garbage to main. + # + # Uses `grep -E` rather than bash's `[[ =~ ]]` for the format check: + # this step's shell is POSIX `sh` (dash) in this container, not + # bash, and `[[` is a bash-only builtin — under `sh` it's silently + # treated as "command not found", which (since a failing `if` + # condition doesn't trigger `sh -e`) was *not* aborting the step, it + # was silently skipping the whole validation and letting malformed + # versions like "2.4" through instead of requiring "2.4.0". - name: Validate and apply version bump env: NEW_VERSION: ${{ inputs.version }} run: | - if [[ ! "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if ! printf '%s' "$NEW_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then echo "version input must look like x.y.z with no leading 'v' (got: '$NEW_VERSION')" >&2 exit 1 fi diff --git a/CHANGELOG.md b/CHANGELOG.md index 196dda5..f452f81 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,30 @@ accurate at all times instead of being reconstructed from memory later. ## Unreleased +### Fix: release workflow failing on every run, unrelated to the PAT +The first real trigger of `.github/workflows/release.yml` (after adding a +`RELEASE_PUSH_TOKEN` secret) failed at the "Commit and push version bump" +step with `fatal: not in a git directory`, despite the checkout step +completing without any git errors moments earlier — a red herring that +looked like a token/auth problem but wasn't. Two real, unrelated bugs: +- The container job's own `actions/checkout` step registers the checkout + path as a git `safe.directory`, but that registration doesn't reliably + carry over to later plain `run:` steps executing inside a job-level + `container:` (this workflow runs inside `devkitpro/devkitarm`) — they + can hit git errors on a directory checkout itself just used fine. Fixed + by explicitly re-adding `git config --global --add safe.directory '*'` + in a step right after checkout, in the same execution context the later + git commands run in. +- Separately (masked until the above was fixed enough to reach it): the + version-format check used bash's `[[ ... =~ ... ]]`, but this step's + shell is POSIX `sh` (dash) in this container, not bash — `[[` doesn't + exist there, and since a failing `if` *condition* doesn't trigger `sh + -e`, the broken check was silently skipped rather than failing the + step, letting a malformed version like `2.4` (missing the patch + number) through instead of requiring `2.4.0`. Rewritten with + `grep -Eq`, which is portable POSIX and was already used elsewhere in + this same script. Verified against real `dash`, not just bash. + ### Changed: release workflow no longer asks for a title `.github/workflows/release.yml`'s `workflow_dispatch` form used to require typing in both a `version` and a `title` (the latter only ever used to