Repository navigation
fix(ci): restrict Kubernetes release skips to the release App - #2439
Merged
Merged
Conversation
Restore Taskfile-only pull request qualification and require the release App author, same-repository head, and release branch before skipping either Kubernetes job. Add offline workflow contract regression coverage. Co-authored-by: Mecatl <noreply@mecatl.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #2432 addressing the two CI coverage findings:
release/*pull requests authored bytoolhive-release-app[bot]. The author login is verified against the actual release PR Release v0.0.49 #2429 using the GitHub API. The condition checks the PR author, notgithub.actor, so the user rerunning a workflow cannot authorize the exemption. Push and manual-dispatch runs remain eligible.Taskfile.ymlto the pull-request path filter because it defines both qualification entry points.No permission, secret, cache, sharding, or runtime changes.
Validation
actionlint .github/workflows/k8s-e2e.ymlandgit diff --check.go run ./cmd/mecademo, including tool call, permission ask/approval, and final result.task lint: root, engine, adaptersupport, driver, adapters, and oidc clean; blocked by the existing Darwin microVM gosec G703 finding atenvironment/microvm/launch_ownership_darwin.go:754(unchanged).task test: attempted; encountered unrelated Unix-socket fixture failures (listen unix /dev/fd/5/microvmd.sock: bind: no such file or directory) and was stopped. The local host also lacks GNUtimeout, needed by existing deploy-script tests.task test:racenot completed. Draft pending clean full gates on a supported environment and CI results.