Repository navigation
polish: release readiness for the dual-backend card #7
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,6 +23,7 @@ on: | |
| default: false | ||
|
|
||
| permissions: | ||
| actions: write | ||
| contents: write | ||
|
|
||
| concurrency: | ||
|
|
@@ -130,6 +131,48 @@ jobs: | |
| git push origin HEAD:${{ github.ref_name }} | ||
| git push origin "v${{ steps.version.outputs.version }}" | ||
|
|
||
| # A tag pushed with GITHUB_TOKEN never fires cicd.yml's push trigger | ||
| # (GitHub suppresses workflow runs caused by that token), so the build | ||
| # and release job is dispatched by hand on the tag ref and watched | ||
| # here until it finishes. | ||
| - name: Dispatch and watch the build and release | ||
| id: publish | ||
| if: ${{ !inputs.dry_run }} | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| TAG: v${{ steps.version.outputs.version }} | ||
| run: | | ||
| set -euo pipefail | ||
| candidate_sha="$(git rev-parse HEAD)" | ||
| before_id="$( | ||
| gh run list --workflow cicd.yml --event workflow_dispatch \ | ||
| --branch "${TAG}" --commit "${candidate_sha}" --limit 1 \ | ||
| --json databaseId --jq '.[0].databaseId // empty' | ||
| )" | ||
| gh workflow run cicd.yml --ref "${TAG}" -f release_run_id="${GITHUB_RUN_ID}" | ||
|
|
||
| run_id="" | ||
| for _ in {1..30}; do | ||
| candidate_id="$( | ||
| gh run list --workflow cicd.yml --event workflow_dispatch \ | ||
| --branch "${TAG}" --commit "${candidate_sha}" --limit 1 \ | ||
| --json databaseId --jq '.[0].databaseId // empty' | ||
| )" | ||
| if [[ -n "${candidate_id}" && "${candidate_id}" != "${before_id}" ]]; then | ||
| run_id="${candidate_id}" | ||
| break | ||
| fi | ||
| sleep 2 | ||
| done | ||
| if [[ -z "${run_id}" ]]; then | ||
| echo "::error::Timed out locating the cicd.yml run for ${TAG}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| run_url="$(gh run view "${run_id}" --json url --jq '.url')" | ||
| echo "run_url=${run_url}" >> "${GITHUB_OUTPUT}" | ||
| gh run watch "${run_id}" --exit-status | ||
|
|
||
| - name: Summary | ||
| run: | | ||
| echo "## Release ${{ inputs.dry_run && '[DRY RUN] ' || '' }}v${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY | ||
|
|
@@ -139,5 +182,5 @@ jobs: | |
| else | ||
| echo "Version bumped: ${{ steps.version.outputs.current }} -> ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "Tag pushed: v${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "Build and release run: ${{ steps.publish.outputs.run_url }}" >> $GITHUB_STEP_SUMMARY | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- release workflow ---'
sed -n '145,200p' .github/workflows/release.yml
printf '%s\n' '--- child workflow references ---'
rg -n -C 4 'workflow_dispatch|release_run_id|gh run watch|run_url|Summary|GITHUB_STEP_SUMMARY' .github/workflows/cicd.yml .github/workflows/release.ymlRepository: hyperb1iss/hyper-light-card Length of output: 6858 🌐 Web query:
💡 Result: In GitHub Actions, every step has an implicit Citations:
🏁 Script executed: #!/bin/bash
set -eu
sed -n '115,190p' .github/workflows/release.ymlRepository: hyperb1iss/hyper-light-card Length of output: 3247 Keep the dispatched run URL visible when the child run fails.
🧰 Tools🪛 zizmor (1.29.0)[info] 185-185: code injection via template expansion (template-injection): may expand into attacker-controllable code (template-injection) 🤖 Prompt for AI Agents |
||
| fi | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperb1iss/hyper-light-card
Length of output: 12309
🌐 Web query:
GitHub CLI gh run list --branch tag workflow_dispatch tag ref behavior REST API branch filter💡 Result:
In GitHub CLI, the
gh run list --branch(or-b) flag is used to filter workflow runs by branch [1][2][3]. Under the hood, this flag passes the provided value as abranchquery parameter to the GitHub REST API endpointGET /repos/{owner}/{repo}/actions/runs(or the specific workflow runs endpoint) [4][5][6]. Key behaviors regarding this filtering: 1. Branch Filtering Logic: The REST APIbranchparameter filters results by the name of the branch associated with the push event [4][5]. If you provide a branch name, the API returns only those workflow runs that occurred on that specific branch [5][7]. 2. Tags and Workflow Dispatch: Thegh run list --branchflag specifically filters by branch name [1][3]. It does not natively support filtering by Git tags or specific workflow_dispatch ref triggers directly through the CLI flag [1][8]. If you need to filter by a tag or a specific dispatch ref, the standard approach is to retrieve the data without the--branchfilter (potentially using--jsonto fetch relevant fields) and then perform client-side filtering using the--jqflag [8]. 3. JSON/JQ Workaround: Because the native CLI flags are limited to exact branch matching, you can use the following pattern to perform more complex filtering (such as excluding a branch or matching a tag) [8]: gh run list --json headBranch,event,displayTitle --jq 'map(select(.headBranch == "your-tag-or-branch-name"))' 4. Limitations: The branch filter is strictly for the branch name [8]. It does not support negation (e.g., "all branches except main") or regular expressions natively within the flag itself [8]. Additionally, users should be aware that results are dependent on the underlying GitHub API behavior, which may occasionally exhibit indexing delays [9]. In summary, whilegh run list --branchmaps directly to the REST API'sbranchquery parameter for branch-based filtering, it is not designed to filter by tags or complex ref patterns, for which client-side processing with--jqis required [5][8].Citations:
Remove the
--branch "${TAG}"filter from both run lookups.gh workflow run --ref "${TAG}"dispatchescicd.ymlon a tag, butgh run list --branchapplies the REST API branch filter. The tag-backedworkflow_dispatchrun may not match that filter, sorun_idremains empty and the release fails after the polling timeout. Identify the new run without the branch filter, then match its commit and event.🤖 Prompt for AI Agents