From 4c91edf8775e1df6a00d6a0f92864cd8dac2348b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robin=20Br=C3=A4mer?= <22003767+robinbraemer@users.noreply.github.com> Date: Sat, 8 Aug 2026 10:38:21 +0200 Subject: [PATCH] fix(build): stabilize tagged build identity --- .github/workflows/release.yml | 5 +++++ .../release/ReleaseAssetVerificationTest.java | 20 +++++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eb92df03a..78c9bc2c1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,6 +39,11 @@ jobs: uses: gradle/actions/setup-gradle@v3 - name: Build + env: + # These values are compiled into Constants.class. Keep tagged builds independent of + # which workflow ref launched a retry and of GitHub's ever-increasing run number. + GIT_BRANCH: ${{ inputs.release_tag || github.event.release.tag_name || github.ref_name }} + BUILD_NUMBER: ${{ github.event_name == 'push' && github.run_number || 0 }} run: ./gradlew build - name: Get version diff --git a/core/src/test/java/com/minekube/connect/release/ReleaseAssetVerificationTest.java b/core/src/test/java/com/minekube/connect/release/ReleaseAssetVerificationTest.java index d41b0d239..c533db793 100644 --- a/core/src/test/java/com/minekube/connect/release/ReleaseAssetVerificationTest.java +++ b/core/src/test/java/com/minekube/connect/release/ReleaseAssetVerificationTest.java @@ -308,4 +308,24 @@ void gradleArchivesAreConfiguredForReproducibleBytes() throws Exception { assertTrue(build.contains("isReproducibleFileOrder = true"), "archive entry order is not deterministic"); } + + /** Tagged builds must not compile workflow-run identity into otherwise reproducible JARs. */ + @Test + @SuppressWarnings("unchecked") + void taggedBuildIdentityIsStableAcrossReleaseRetries() throws Exception { + List> steps = readBuildJobSteps(); + int buildAt = stepIndex(steps, "Build"); + assertTrue(buildAt >= 0, "build job is missing the Build step"); + + Map env = (Map) steps.get(buildAt).get("env"); + assertTrue(env != null, "Build step has no stable release environment"); + assertEquals( + "${{ inputs.release_tag || github.event.release.tag_name || github.ref_name }}", + String.valueOf(env.get("GIT_BRANCH")), + "tagged builds depend on the workflow ref that happened to launch them"); + assertEquals( + "${{ github.event_name == 'push' && github.run_number || 0 }}", + String.valueOf(env.get("BUILD_NUMBER")), + "tagged builds compile GitHub's changing run number into Constants.class"); + } }