Restore the master guard on the release workflow - #3027
Merged
Conversation
The pre-migration workflow carried `if: github.ref == 'refs/heads/master'`. Moving to tanem/release-action dropped it, because the locked fleet workflow shape does not carry one. That was a silent regression, not a decision. The cron only ever fires on the default branch, so the guard looks redundant until you notice workflow_dispatch can target any branch. Without it, dispatching the release against a version branch bumps, tags, and publishes that branch to npm as latest — shipping a major that was deliberately being staged away from master. `57c2502b` widened ci.yml to build v* branches precisely so that staging work there is possible, which is what makes the hole reachable. No v* branch exists on this repo today, so nothing has shipped wrongly. react-svg and svg-injector keep the same guard through their migrations, so all three now agree. The locked shape in the decision spec still lacks it; ticket 09 will otherwise stamp the same hole into every new fleet repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pre-migration
release.ymlcarriedif: github.ref == 'refs/heads/master'. The move totanem/release-actiondropped it, because the locked fleet workflow shape does not carry one. That was a silent regression rather than a decision, and this restores it.The guard looks redundant at first glance — the cron only ever fires on the default branch — until you notice that
workflow_dispatchcan target any branch. Without the guard, dispatching the release against a version branch would bump, tag and publish that branch to npm aslatest, shipping exactly the major that was being staged away from master on purpose. Note that restrictingci.yml's branch filter would not close this: dispatch reaches any branch regardless of what CI builds.57c2502bwidenedci.ymlto buildv*branches so that staging work there is possible, which is what makes the hole reachable. Nov*branch exists on this repo today, so nothing has shipped wrongly.react-svg and svg-injector keep the same guard through their in-flight migrations, so all three agree once those land. The locked shape in the decision spec still lacks it, which is worth fixing before the generator starts stamping new fleet repos.