fix(ci): make the release dispatch refuse anything but its own tag - #54
Closed
johncarmack1984 wants to merge 1 commit into
Closed
fix(ci): make the release dispatch refuse anything but its own tag#54johncarmack1984 wants to merge 1 commit into
johncarmack1984 wants to merge 1 commit into
Conversation
A manual dispatch ran the publish job unconditionally with an optional tag input documented as "leave blank to build current main". Publish writes to a key derived from version.txt, so a blank dispatch builds main and overwrites whatever release that version already published. I did exactly that tonight and replaced the shipped v1.0.0 DMG with a build of main. Signed and notarized, so it opens, but not the artifact that passed QA. The tag input is required now, and a guard refuses unless the tag exists, HEAD is that tag's commit, and version.txt at the tag matches it. It runs before the signing secret is loaded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A manual
workflow_dispatchof the release workflow ran the publish job unconditionally, and thetaginput was optional with the documented behaviour "leave blank to build current main". The publish step writes to a key derived fromversion.txt, so a blank dispatch buildsmainand overwrites whatever release that version already published, with a different binary under its name.That is not hypothetical. I did it tonight: dispatched with no tag to re-test release-please, and it replaced the shipped v1.0.0 DMG with a build of
main. Signed and notarized, so it opens, but it is not the artifact that passed QA. No customer had bought it, which is the only reason this cost nothing.Two changes:
tagis now required on dispatch.HEADis exactly that tag's commit, andversion.txtat that tag matches it. Any mismatch fails the job before the signing secret is even loaded.fetch-depth: 0so the guard can resolve tags.Not covered here
newearth-llc-downloadshas no bucket versioning, which is why the original DMG was unrecoverable. That bucket is Terraformed in thenewearth.llcrepo (infra-downloads/), so it needs a change over there. A one-lineaws_s3_bucket_versioningwould have made this a single-command restore.