Skip to content

fix(ci): publish an explicit qualification run #264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alongubkin wants to merge 1 commit into
base: main
Choose a base branch
from
+46 −20
Open

fix(ci): publish an explicit qualification run #264

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 46 additions & 20 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ on:
type: string
required: false
default: main
qualification_run_id:
type: string
required: false
default: ""
dry_run:
type: boolean
required: false
Expand Down Expand Up @@ -40,6 +44,10 @@ on:
description: Exact 40-character source commit for dev npm packages
type: string
default: main
qualification_run_id:
description: Successful qualification run to publish (optional)
type: string
default: ""
dry_run:
description: Validate without publishing
type: boolean
Expand Down Expand Up @@ -331,28 +339,46 @@ jobs:
GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
RELEASE_COMMIT: ${{ steps.merged_version.outputs.commit }}
VERSION: ${{ steps.merged_version.outputs.version }}
QUALIFICATION_RUN_ID: ${{ inputs.qualification_run_id }}
run: |
PR_JSON=$(gh api \
-H "Accept: application/vnd.github+json" \
"/repos/${GITHUB_REPOSITORY}/commits/${RELEASE_COMMIT}/pulls" \
--jq '[.[] | select(.base.ref == "main" and .merged_at != null)] | sort_by(.merged_at) | last')
HEAD_SHA=$(jq -r '.head.sha // empty' <<< "$PR_JSON")
if [ -z "$HEAD_SHA" ]; then
echo "::error::The release commit is not associated with a merged pull request"
exit 1
fi
if [ -n "$QUALIFICATION_RUN_ID" ]; then
if ! grep -qE '^[0-9]+$' <<< "$QUALIFICATION_RUN_ID"; then
echo "::error::qualification_run_id must be a GitHub Actions run ID"
exit 1
fi
RUN_JSON=$(gh run view "$QUALIFICATION_RUN_ID" \
--repo "$GITHUB_REPOSITORY" \
--json conclusion,workflowName)
if [ "$(jq -r '.conclusion' <<< "$RUN_JSON")" != "success" ] || \
[ "$(jq -r '.workflowName' <<< "$RUN_JSON")" != "Release qualification" ]; then
echo "::error::qualification_run_id must name a successful Release qualification run"
exit 1
fi
RUN_ID="$QUALIFICATION_RUN_ID"
HEAD_SHA="$RELEASE_COMMIT"

@greptile-apps greptile-apps Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Qualification source identity is overwritten

When an explicit run ID selects the successful qualification created for a release PR head, this branch replaces that run's source SHA with the distinct merged commit SHA. The subsequent manifest comparison rejects the valid run with Qualified artifact set does not match the merged release tree, and image verification would likewise look for a tag based on the wrong SHA.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 358

Comment:
**Qualification source identity is overwritten**

When an explicit run ID selects the successful qualification created for a release PR head, this branch replaces that run's source SHA with the distinct merged commit SHA. The subsequent manifest comparison rejects the valid run with `Qualified artifact set does not match the merged release tree`, and image verification would likewise look for a tag based on the wrong SHA.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Codex

else
PR_JSON=$(gh api \
-H "Accept: application/vnd.github+json" \
"/repos/${GITHUB_REPOSITORY}/commits/${RELEASE_COMMIT}/pulls" \
--jq '[.[] | select(.base.ref == "main" and .merged_at != null)] | sort_by(.merged_at) | last')
HEAD_SHA=$(jq -r '.head.sha // empty' <<< "$PR_JSON")
if [ -z "$HEAD_SHA" ]; then
echo "::error::The release commit is not associated with a merged pull request"
exit 1
fi

RUN_ID=$(gh run list \
--repo "$GITHUB_REPOSITORY" \
--workflow release-qualification.yml \
--commit "$HEAD_SHA" \
--status success \
--limit 1 \
--json databaseId \
--jq '.[0].databaseId // empty')
if [ -z "$RUN_ID" ]; then
echo "::error::No successful release qualification exists for ${HEAD_SHA}"
exit 1
RUN_ID=$(gh run list \
--repo "$GITHUB_REPOSITORY" \
--workflow release-qualification.yml \
--commit "$HEAD_SHA" \
--status success \
--limit 1 \
--json databaseId \
--jq '.[0].databaseId // empty')
if [ -z "$RUN_ID" ]; then
echo "::error::No successful release qualification exists for ${HEAD_SHA}"
exit 1
fi
fi

mkdir -p qualification
Expand Down
Loading