Gate release tag creation - #11
Conversation
Require a version-matched release branch at current main, create an immutable tag, and explicitly dispatch publication with a pinned tag and SHA.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3775effd8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if not remote_tag or remote_tag[0] != release_sha: | ||
| raise SystemExit(f"tag {actual!r} does not resolve to {release_sha}") |
There was a problem hiding this comment.
When a repository writer directly invokes workflow_dispatch or pushes a matching version tag, this check accepts any tag/SHA whose checked-out package version matches, even if that commit would fail the new release branch's current-main check. gh workflow run --help confirms that --ref main only selects the ref containing the workflow file; it does not constrain release_sha to main. Consequently, publication can still bypass the claimed release gate, so this workflow should independently compare the supplied SHA with current main or otherwise verify that the gated workflow authorized it.
Useful? React with 👍 / 👎.
1 participant
Summary
release/vX.Y.Zinitiation gatemainand matchpyproject.tomlWhy
Tags created by the repository
GITHUB_TOKENdo not trigger ordinary push workflows. GitHub explicitly permitsworkflow_dispatchas the recursion-safe exception, so the gate dispatchespublish.ymldirectly with pinned inputs.Verification
release/v0.10.0mainruns are fully green on Python 3.9–3.14 for Linux/Windows, build/install smoke, and hostile-input Action contract