ci: convert release pipeline to dispatcher + tag-dispatched validators#4072
Draft
sydorovdmytro wants to merge 3 commits into
Draft
ci: convert release pipeline to dispatcher + tag-dispatched validators#4072sydorovdmytro wants to merge 3 commits into
sydorovdmytro wants to merge 3 commits into
Conversation
Builder release.yaml becomes workflow_dispatch-only (release-as-output): goreleaser creates the GitHub release at the end of a green build, so a monorepo-created OSS release can no longer re-trigger this builder (closes the DEVOPS-1013 gap). Decouples check_minimum_version_tag/notify_failure from github.event.release.*, derives the version from the dispatched tag, and fixes previous_tag to be branch-local. Validators (e2e, e2e-ginkgo, unit-tests) move from release:created to on: workflow_run keyed on the "Release" builder completing - release:created does not fire for builder-created releases inside Actions. On that path detect_changes is bypassed and the full suite runs against the built tag (github.event.workflow_run.head_branch). Related to DEVOPS-1050
This was referenced Jul 13, 2026
E2E Ginkgo Tests
|
…-1050) main is the only validator copy that fires on workflow_run, so without a gate it would also validate legacy (< v0.37) releases against the newer main test orchestration (drift risk). release_line_gate restricts the workflow_run path to new lines; legacy lines are builder-only, matching current behavior. PR path unchanged.
…run (DEVOPS-1050) The release builder now dispatches each validator via `gh workflow run <wf> --ref <tag>`, so every validator runs its OWN version at the built tag rather than being triggered by a workflow_run on the "Release" builder completing. workflow_dispatch is a trusted trigger, so a plain checkout of the tag is correct and this clears the CodeQL "untrusted checkout in privileged context" alerts that the workflow_run + `ref: head_branch` model raised. - e2e.yaml, e2e-ginkgo.yaml, unit-tests.yaml: drop the workflow_run trigger and the release_line_gate job; the builder only dispatches new release lines, so the gate is no longer needed. Job `if:` conditions now take the release path via `github.event_name == 'workflow_dispatch'`, and the `ref: head_branch` checkout overrides are removed (a --ref <tag> dispatch already sets github.ref to the tag). - unit-tests.yaml gains a bare workflow_dispatch trigger so the builder can dispatch it at the tag. - e2e-ginkgo.yaml resolves the release label filter from startsWith(github.ref, 'refs/tags/') instead of the workflow_run event. - release.yaml gains a trigger-validators job that dispatches the three validators at the built tag once publish succeeds (skipping -next).
sydorovdmytro
changed the title
sydorovdmytro
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reference conversion for DEVOPS-1050 phase 4 (loft-sh/vcluster
main). Draft.Builder (
release.yaml)on: release:[created]→on: workflow_dispatch. The GitHub Release is a pipeline output (goreleaser creates it at the end of a green build), dispatched by the sharedvcluster-releaseaction viagh workflow run release.yaml --ref <tag>. Nothing listens onrelease:created, closing the DEVOPS-1013 re-trigger gap.github.event.release.*→github.ref_name; branch-localprevious_tag.trigger-validatorsjob: on a green, non--nextbuild it dispatches each validator at the built tag (gh workflow run <wf> --ref <tag>,GITHUB_TOKEN+actions: write), guarded so a missing validator warns instead of failing.Validators (
e2e.yaml,e2e-ginkgo.yaml,unit-tests.yaml)on: workflow_dispatch(+pull_request).unit-testsgains aworkflow_dispatchtrigger so it is dispatchable at the tag.--ref <tag>, so each validator runs its own tag's version against the tag's code — glue and code both from the release line (no main-branch drift).detect_changesstays PR-only; the release path (workflow_dispatch) runs the full suite.e2e-ginkgoresolves the release label filter whengithub.refis a tag.Why dispatch, not
workflow_runworkflow_runis a privileged trigger; checking out the built tag under it tripped CodeQL “untrusted checkout in a privileged context” (3 critical + 2 high).workflow_dispatchis a trusted trigger — no untrusted-checkout finding, no alert dismissals — and it lets each validator run the tag's own version rather thanmain's.Legacy vs new lines
Only
main/new-line (>= v0.37) builders carrytrigger-validators, so legacy lines (v0.31–v0.35, builder-only PRs) get no post-build validation — matching current behavior. A validator and its dispatch entry travel together per branch, so av0.37branch cut frommainhas everything it needs.Actionlint-clean; release-as-output + dispatch flow proven on the throwaway fixtures. Draft until the GitHub Actions incident clears and CI can run.