fix(ci): release.yml refuses a version below the highest release and a major tag move that is not a fast-forward - #48
Merged
Conversation
…a major tag move that is not a fast-forward Closes #42 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
release.ymlgains one fail-closed step before the release is created: the pushed version must sort strictly above the highestvX.Y.Zalready cut (across majors), and the tagged commit must descend from the commit of that highest release and from the commitvXnames (or be that commit, on a re-run). Agit ls-remotethat cannot be read fails the step. AGENTS.md and.claude/commands/publish.mdnote that a fix to the workflow never reaches a stored run (a re-run replays the tagged commit's revision; the ruleset closes that path). The root README and the four action READMEs say what a tag does: never deleted or rewound (thev*ruleset blocks both, for admins too), still movable forward by a writer; a commit SHA freezes.Why
Closes #42. The rulesets and the remote tag state were read and recorded on the issue, with the amended choices (equality allowed on a re-run, no
run_attemptbinding, the cross-major floor).How to test
The step was replayed on a scratch remote under
bash -e: rollback tag on an older commit, lower version at the tip, re-run of an older release once a newer exists,v2.0.0on an old commit and an unreachable remote are refused; a normal release, a re-run of the latest,v2.0.0at the tip and a first release ever are accepted. actionlint 1.7.12 is clean.Review
Review subagent: green after one round (fail-open on a failed remote lookup, fixed). Security review: no findings after one round (the cross-major hole, fixed). Minors all fixed.
🤖 Generated with Claude Code