Repository navigation
ci: harden release pipeline - #273
Merged
Merged
Conversation
- Run backend and frontend tests before building release artifacts; PR
checks are path-filtered, so this is the only gate guaranteed to run
on every tagged commit.
- Make draft release creation idempotent: "gh release view || create"
plus "gh release upload --clobber", so workflow re-runs and re-pushed
tags no longer die on an existing release.
- Verify checksums of the downloaded linux binaries in the docker
workflow (fail-closed, requires both entries).
- Set cancel-in-progress to false for tag/release jobs so a run is
never killed mid "gh release create"/upload or mid image push; main
branch builds keep superseding each other.
- Remove dead version plumbing in scripts.sh (resolve_version and the
unread VITE_FUSION_VERSION env); the displayed version comes solely
from vite.config.ts's git describe.
- Fix the docker tags comment: {{version}} emits "1.2.3" without the
"v", and "latest" comes from metadata-action's default flavor on
non-prerelease semver.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Hardens the tag-push release pipeline after an adversarial review of the flow. No structural change: still tag push → draft release → manual publish → docker reuses release binaries.
Changes
./scripts.sh test(backend + frontend) before building artifacts. PR checks are path-filtered, so this is the only gate guaranteed to run on every tagged commit.gh release view || create --draft --generate-notes+gh release upload --clobber. Workflow re-runs and re-pushed tags no longer die on "release already exists".checksums.txtandsha256sum --strict -cthe two linux binaries (fail-closed; requires both entries).cancel-in-progress: falseon the release workflow; on docker,cancel-in-progress: ${{ github.event_name == 'push' }}keeps superseding stale main builds but never kills a release image mid-push. A killed run leaves partial draft assets or a half-pushed multi-arch manifest.scripts.sh(resolve_version, unreadVITE_FUSION_VERSIONenv, misleading "Using fusion version string" log). The displayed version comes solely fromvite.config.ts(git describe --tags --always→__APP_VERSION__); each build path keeps its current correct output.{{version}}emits1.2.3(no leadingv);latestcomes from metadata-action's default flavor on non-prerelease semver.Operational notes
--clobberre-uploads complete assets.pushtrigger todocker.ymllater without revisiting its concurrency group: it would share a group with the release-event run and could cancel it mid-push.Verified locally:
sh -n scripts.sh, YAML parse of both workflows, and a simulation of the checksum verification (valid passes, tampered and single-entry rejected).