mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
30ca980b49
Mobile candidates currently require the current `main` commit, so a stable release branch cannot publish through the existing protected tag workflow. Add optional `--source-branch mobile-vMAJOR.MINOR` selection while preserving `main` as the default. Both the command and App-backed publisher reject a stable branch whose major/minor differs from the requested version. Candidates retain exact-tip checks and immutable annotated tags; the private build pipeline is unchanged. Document the temporary stable-only distribution policy and explicit per-fix backport decisions. No candidate, build, or upload is triggered by this change. No duplicate implementation was found among open release PRs. Stable publication now checks active review and status-check protection in both the operator and publisher. The process permits approved backport PRs and stable-only corrections for regressions caused by earlier backports. Administrator activation and verification of the no-bypass ruleset remain outstanding; non-admin API responses hide the bypass actor list. ### Validation - Full local `just ci` passed during preparation; the final changes affect shell release tooling, its workflow inputs, CI path detection, and documentation. - Publisher contract passed, including version-matched stable sources and mismatched branch rejection. - Operator contract covers default main, a divergent stable commit, missing or mismatched sources, immutable sequencing, and publication races. The final operator contract run passed. - Updated publisher and operator contracts pass, including 17 weakened-policy cases and rejection of unavailable protection. The live, currently unprotected stable branch is rejected. --------- Signed-off-by: Tom Brow <tomb@block.xyz>
76 lines
2.4 KiB
YAML
76 lines
2.4 KiB
YAML
name: Publish Mobile Release Candidate
|
|
run-name: Publish mobile-v${{ inputs.version }}-rc.${{ inputs.candidate_number }}
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: Mobile marketing version (X.Y.Z)
|
|
required: true
|
|
type: string
|
|
candidate_number:
|
|
description: Expected next release-candidate number
|
|
required: true
|
|
type: string
|
|
source_branch:
|
|
description: Source branch (main or mobile-vMAJOR.MINOR matching version)
|
|
required: true
|
|
default: main
|
|
type: string
|
|
target_sha:
|
|
description: Exact current source branch commit
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: mobile-release-candidate-${{ inputs.version }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Require the reviewed workflow from main
|
|
env:
|
|
DISPATCH_REF: ${{ github.ref }}
|
|
run: |
|
|
if [ "$DISPATCH_REF" != "refs/heads/main" ]; then
|
|
echo "::error::Mobile candidates must be dispatched from main, not $DISPATCH_REF"
|
|
exit 1
|
|
fi
|
|
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Require canonical repository
|
|
env:
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
if [ "$REPOSITORY" != "block/buzz" ]; then
|
|
echo "::error::Mobile candidate publication is restricted to block/buzz"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Create release tagger token
|
|
id: release-tagger
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }}
|
|
private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }}
|
|
permission-contents: write
|
|
|
|
- name: Publish annotated candidate tag
|
|
env:
|
|
GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
|
|
MOBILE_VERSION: ${{ inputs.version }}
|
|
CANDIDATE_NUMBER: ${{ inputs.candidate_number }}
|
|
SOURCE_BRANCH: ${{ inputs.source_branch }}
|
|
TARGET_SHA: ${{ inputs.target_sha }}
|
|
run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" "$SOURCE_BRANCH"
|