Gate releases on CI/audit status before tagging#15
Merged
Conversation
publish.yml triggers on push: tags: ["v*"] with no dependency on ci.yml or audit.yml passing, and GitHub Actions has no way for one workflow file to `needs:` a job defined in another, so this has to be enforced before the tag exists rather than inside publish.yml itself. Adds scripts/check-release-ready.sh, which resolves a ref to a commit SHA and checks the latest ci.yml/audit.yml runs for that SHA via `gh run list -c <sha>`, failing if either hasn't run, hasn't completed, or didn't succeed. Also adds RELEASING.md, since there was no written release checklist, with the check as an explicit pre-tag step. Closes #14
git rev-parse on an annotated tag returns the tag object's own SHA, not the commit it points at, so gh run list -c <sha> would never find a matching run when checking a tag ref (the script's primary intended use case).
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
openwraw-docs | 2bf872a | Jul 18 2026, 10:48 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
push: tags: ["v*"]with no dependency onci.ymloraudit.ymlpassing. GitHub Actions has no way for one workflow file toneeds:a job defined in another workflow file, so this has to be enforced before the tag exists rather than insidepublish.ymlitself.scripts/check-release-ready.sh, which resolves a ref (defaultHEAD) to a commit SHA and checks the latestci.ymlandaudit.ymlruns for that SHA viagh run list -w <workflow> -c <sha>. It fails (exit 1, with a message and run URL when available) if a run is missing, hasn't completed, or didn't succeed; it exits 0 with a one-line confirmation only when both are green.RELEASING.md, since there was no written release checklist in this repo. Documents the (single-location) version bump, changelog, commit, and tag/push/publish/verify steps, with the readiness check as an explicit pre-tag step.Test plan
./scripts/check-release-ready.shagainst currentmainHEAD: correctly reportedci.ymlgreen andaudit.ymlwith no run found for that commit (audit.yml is path-filtered to Cargo.toml/Cargo.lock changes, so this is expected/correct behavior for a docs-only commit), and exited 1.103cb18(release: v1.2.4, which touched Cargo.toml): both checks passed, exited 0.6086931(release: v1.2.5): correctly reportedci.ymlfailed (conclusion=failure) with the run URL, and exited 1.bash -n scripts/check-release-ready.sh(syntax check).Closes #14