A caller cannot ask this workflow to validate a specific fullsend commit — only a branch or tag name. That leaves fullsend's release gate open to a tag move, and the gap cannot be closed from the caller's side.
Why it can't be pinned today
At main (ac9f2e1a):
:256-263 — Validate fullsend ref rejects anything that is not main and does not match ^v[0-9], so a 40-hex SHA fails the job outright.:268-272 — Clone fullsend runs git clone --depth 1 --branch "${FULLSEND_REF}", which does not accept a commit SHA either.
Why it matters now
Since fullsend-ai/fullsend#6986, fullsend's release.yml publishes the binary only after this workflow passes, and it passes fullsend_ref: ${{ github.ref_name }} — the tag name. Functional tests take ~45 minutes. If the release tag is moved during that window, this workflow validates one commit while GoReleaser publishes another, and the gate silently certifies the wrong tree.
fullsend #6986 mitigates that with a recheck-tag job: it verifies the tag resolves to github.sha both before validation starts and again after it finishes, so a mid-gate move fails the release instead of publishing. That makes the window fail closed, which is the best available answer — but it is a detection, not a pin. The gate still clones by a mutable name.
Ask
Let the caller pass an immutable ref. Either:
- widen
fullsend_ref to also accept ^[0-9a-f]{40}$, and for that case clone the default branch (or fetch the ref) and git checkout the SHA rather than using --branch; or
- add a separate optional
fullsend_sha input that, when set, is checked out after cloning and asserted to be the commit fullsend_ref names — which keeps the tag around for anything that wants the version string, while making the tested tree immutable.
(2) is probably less disruptive to existing callers, and it lets fullsend keep passing the tag for --version/go-build purposes while pinning what is actually tested.
Once this exists, fullsend can pass github.sha and its recheck-tag job becomes redundant.
Related: fullsend-ai/fullsend#6986, and #1182 (surface whether tests actually ran).
A caller cannot ask this workflow to validate a specific fullsend commit — only a branch or tag name. That leaves fullsend's release gate open to a tag move, and the gap cannot be closed from the caller's side.
Why it can't be pinned today
At
main(ac9f2e1a)::256-263—Validate fullsend refrejects anything that is notmainand does not match^v[0-9], so a 40-hex SHA fails the job outright.:268-272—Clone fullsendrunsgit clone --depth 1 --branch "${FULLSEND_REF}", which does not accept a commit SHA either.Why it matters now
Since fullsend-ai/fullsend#6986, fullsend's
release.ymlpublishes the binary only after this workflow passes, and it passesfullsend_ref: ${{ github.ref_name }}— the tag name. Functional tests take ~45 minutes. If the release tag is moved during that window, this workflow validates one commit while GoReleaser publishes another, and the gate silently certifies the wrong tree.fullsend #6986 mitigates that with a
recheck-tagjob: it verifies the tag resolves togithub.shaboth before validation starts and again after it finishes, so a mid-gate move fails the release instead of publishing. That makes the window fail closed, which is the best available answer — but it is a detection, not a pin. The gate still clones by a mutable name.Ask
Let the caller pass an immutable ref. Either:
fullsend_refto also accept^[0-9a-f]{40}$, and for that case clone the default branch (or fetch the ref) andgit checkoutthe SHA rather than using--branch; orfullsend_shainput that, when set, is checked out after cloning and asserted to be the commitfullsend_refnames — which keeps the tag around for anything that wants the version string, while making the tested tree immutable.(2) is probably less disruptive to existing callers, and it lets fullsend keep passing the tag for
--version/go-buildpurposes while pinning what is actually tested.Once this exists, fullsend can pass
github.shaand itsrecheck-tagjob becomes redundant.Related: fullsend-ai/fullsend#6986, and #1182 (surface whether tests actually ran).