feat(validatereleasetag): validate release tag - #69
Conversation
ref: AB#22954
There was a problem hiding this comment.
Pull request overview
Adds explicit release-tag validation to the GitHub Actions publish flow so PyPI publishing only proceeds for GA-style tags (vX.Y.Z), aligning the workflow trigger/conditions with tag-based releases.
Changes:
- Broadened workflow tag trigger to
v*(GitHub Actions tag patterns are glob-based). - Restricted the
publishjob to run only on tag pushes (refs/tags/v...), notmasterpushes. - Added a bash validation step that hard-fails publishing when the tag is not exactly
v<major>.<minor>.<patch>.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| branches: [master] | ||
| tags: | ||
| - 'v[0-9]+\.[0-9]+\.[0-9]+' | ||
| - "v*" |
There was a problem hiding this comment.
previous match was more correct. "v*" matches also "vaffanzul"
| if: ${{ always() }} | ||
|
|
||
| publish: | ||
| if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')) |
There was a problem hiding this comment.
this triggers on any push on master?! tags are not master ...
this clearly has not been tested
| run: | | ||
| TAG="${GITHUB_REF_NAME}" | ||
|
|
||
| if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then |
There was a problem hiding this comment.
where is the ancestor branch check?
this only check that the tag is a semver release, doens't ensure is on master branch.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
.github/workflows/python-tests.yml:104
- The validation hard-codes
masterin both the fetch and the ancestry check. This adds another place to update if the default branch name changes; the workflow already has access to the repo default branch via the event payload.
git fetch origin master
if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/master"; then
echo "::error::Release tag $TAG does not point to a commit contained in master."
exit 1
| publish: | ||
| if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')) | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') | ||
| runs-on: ubuntu-latest |
ref: AB#22954