Repository navigation
ci: gate release pull requests on the trusted release checks - #1134
Merged
Merged
Conversation
The release pull request merged before its lockfile refresh landed, leaving workspace crate versions at 0.157.0 in Cargo.lock. This is the same cargo update --workspace result the release workflow produced.
Compare each workspace crate's Cargo.lock entry with its manifest version and the uv.lock project entry with pyproject.toml, offline, so a release whose lockfile refresh did not land fails a check instead of merging.
… Verify Release Please pull requests are version-only, so the Verify workflow skipped their suites and its Verify check run succeeded within seconds. That check run satisfied the required Verify before the release job pushed the lockfile refresh and before its trusted checks posted Verify on the refreshed head. On same-repository release-please-- branches the Verify workflow's aggregate job now reports as "Release pull request suites" (it still always runs; a skipped job would count as passing). The only Verify on such a head is the commit status from the release checks, so the pull request waits until they pass on its current head, and every later push waits again. The release checks also run the offline version check before dispatching anything. A check-release-gate static check, part of check-ci, models how the ruleset resolves Verify for release, feature, fork and merge group pull requests against the real workflow files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Release pull request #1133 became mergeable seconds after Release Please opened it: the normal Verify job skipped its suites on the version-only commit and produced a successful Verify check run before the trusted release checks pushed the lockfile refresh and posted Verify. It merged with Cargo.lock still at 0.157.0.
Changes
Verification