mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
5730c83f7d
Mobile candidate publication currently fails if the source branch advances after selection, and the operator can report failure even after the correct immutable tag was created. It also prevents releasing an explicitly selected historical baseline. Add `--commit FULL_SHA` and independently verify in the operator and publisher that the selected commit belongs to the selected source branch's history. Compare immutable SHAs, keep the candidate pinned through publication, and verify the resulting annotated tag instead of requiring the branch to remain stationary. Stable-branch review/check protection and immutable-tag permissions remain enforced. Without `--commit`, selection still defaults to the current source tip. ### Validation - Updated operator and publisher contracts pass: historical main/stable selection, branch advancement during publication, unrelated or missing commits, ancestry lookup failure, and unchanged tag/sequence checks. - Removing ancestry enforcement causes the unrelated-history regression to fail. - Live read-only ancestry verification accepts the original 0.24 baseline. Local publication stops at the existing App-permission check; no tag or build was created. - Full local `just ci` passed. Signed-off-by: Tom Brow <tomb@block.xyz>
76 lines
2.4 KiB
YAML
76 lines
2.4 KiB
YAML
name: Publish Mobile Release Candidate
|
|
run-name: Publish mobile-v${{ inputs.version }}-rc.${{ inputs.candidate_number }}
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: Mobile marketing version (X.Y.Z)
|
|
required: true
|
|
type: string
|
|
candidate_number:
|
|
description: Expected next release-candidate number
|
|
required: true
|
|
type: string
|
|
source_branch:
|
|
description: Source branch (main or mobile-vMAJOR.MINOR matching version)
|
|
required: true
|
|
default: main
|
|
type: string
|
|
target_sha:
|
|
description: Pinned commit in the selected source branch history
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: mobile-release-candidate-${{ inputs.version }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Require the reviewed workflow from main
|
|
env:
|
|
DISPATCH_REF: ${{ github.ref }}
|
|
run: |
|
|
if [ "$DISPATCH_REF" != "refs/heads/main" ]; then
|
|
echo "::error::Mobile candidates must be dispatched from main, not $DISPATCH_REF"
|
|
exit 1
|
|
fi
|
|
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Require canonical repository
|
|
env:
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
if [ "$REPOSITORY" != "block/buzz" ]; then
|
|
echo "::error::Mobile candidate publication is restricted to block/buzz"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Create release tagger token
|
|
id: release-tagger
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }}
|
|
private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }}
|
|
permission-contents: write
|
|
|
|
- name: Publish annotated candidate tag
|
|
env:
|
|
GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
|
|
MOBILE_VERSION: ${{ inputs.version }}
|
|
CANDIDATE_NUMBER: ${{ inputs.candidate_number }}
|
|
SOURCE_BRANCH: ${{ inputs.source_branch }}
|
|
TARGET_SHA: ${{ inputs.target_sha }}
|
|
run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" "$SOURCE_BRANCH"
|