From 2121b8654fe4bd6dd054c05036039c85adba993a Mon Sep 17 00:00:00 2001 From: Alon Gubkin Date: Thu, 30 Jul 2026 15:46:53 +0300 Subject: [PATCH 1/2] fix(ci): requalify exact merged release commits --- .github/workflows/release-qualification.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-qualification.yml b/.github/workflows/release-qualification.yml index 324657327..cc9170fc5 100644 --- a/.github/workflows/release-qualification.yml +++ b/.github/workflows/release-qualification.yml @@ -57,7 +57,16 @@ jobs: --jq '[.[] | select(.base.ref == "main")] | sort_by(.updated_at) | last') HEAD_REPOSITORY=$(jq -r '.head.repo.full_name // empty' <<< "$PR_JSON") HEAD_REF=$(jq -r '.head.ref // empty' <<< "$PR_JSON") - BASE_SHA=$(jq -r '.base.sha // empty' <<< "$PR_JSON") + MERGE_COMMIT_SHA=$(jq -r '.merge_commit_sha // empty' <<< "$PR_JSON") + if [ "$MERGE_COMMIT_SHA" != "$SOURCE_REF" ]; then + echo "::error::Workflow dispatch requalification requires the exact merged release commit" + exit 1 + fi + # The PR's recorded base can be stale when another PR lands between + # qualification and merge. Compare the exact merged commit with its + # first parent so concurrent main changes are not misclassified as + # release-PR changes. + BASE_SHA=$(git rev-parse "${SOURCE_REF}^") fi CURRENT_VERSION=$(sed -n '/^\[workspace.package\]/,/^\[/s/^version = "\(.*\)"/\1/p' Cargo.toml) From 7f5e4c51b01af548f67161cd05c17d43308bb8c2 Mon Sep 17 00:00:00 2001 From: Alon Gubkin Date: Thu, 30 Jul 2026 16:07:59 +0300 Subject: [PATCH 2/2] fix(ci): select matching release merge association --- .github/workflows/release-qualification.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-qualification.yml b/.github/workflows/release-qualification.yml index cc9170fc5..470a739d0 100644 --- a/.github/workflows/release-qualification.yml +++ b/.github/workflows/release-qualification.yml @@ -53,8 +53,9 @@ jobs: else PR_JSON=$(gh api \ -H "Accept: application/vnd.github+json" \ - "/repos/${GITHUB_REPOSITORY}/commits/${SOURCE_REF}/pulls" \ - --jq '[.[] | select(.base.ref == "main")] | sort_by(.updated_at) | last') + "/repos/${GITHUB_REPOSITORY}/commits/${SOURCE_REF}/pulls" | + jq --arg source "$SOURCE_REF" \ + '[.[] | select(.base.ref == "main" and .merge_commit_sha == $source)] | last') HEAD_REPOSITORY=$(jq -r '.head.repo.full_name // empty' <<< "$PR_JSON") HEAD_REF=$(jq -r '.head.ref // empty' <<< "$PR_JSON") MERGE_COMMIT_SHA=$(jq -r '.merge_commit_sha // empty' <<< "$PR_JSON")