Repository navigation
ci: gate crates publication on the release revision's CI result - #130
Merged
Merged
Conversation
Add a required `required-check-runs` input to release-plz-crates.yml and a `release-ci-gate` job between `package-preflight` and `release`. The gate polls the check-runs API for the named checks on the release revision, waits while they are pending, passes only on `success`, and fails fast on any other conclusion or after a 40-minute deadline, so publication and tag creation cannot run ahead of the caller's authoritative CI result. Callers pass their gate check names and grant `checks: read` on the reusable call; the mechanism is documented in release-engineering.md. Refs #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #125
What changed
release-plz-crates.yml: new requiredrequired-check-runsinput (comma-separated check-run names); newrelease-ci-gatejob betweenpackage-preflightandreleasethat polls the check-runs API for those names ongithub.sha.releasenow needs both jobs.docs/release-engineering.md: records the encoded gate mechanism and the callerchecks: readrequirement.Gate semantics (all paths exercised locally with a stubbed
gh api): PASS oncompleted/success, continue onqueued/in_progress/pending/missing, immediate fail on any other conclusion or API error, refuse an empty input, hard deadline at 40 minutes (timeout-minutes: 45).Ordering
This merges first. Callers (
workshop-rs,opy-rs) then passrequired-check-runsand addchecks: readto theirpermissions— the gate fails closed if they don't, which is the intended enforcement.deltin-rsis paused per its issue scope.Verification
actionlintv1.7.12 clean;bash -non the embedded script; functional walk-through of all six outcomes (success, mixed pending, failure, empty input, API error, timeout).