fix(release): own exact identifier publication - #1183
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 510e57367e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| gh run watch "${target_run_id}" \ | ||
| --repo registrystack/registrystack-id \ | ||
| --exit-status |
There was a problem hiding this comment.
When this job uses the documented fine-grained IDENTIFIER_PUBLISHER_TOKEN, gh run watch cannot authenticate: gh run watch --help states, “This command does not support authenticating via fine grained PATs” because the required checks:read permission is unavailable. Consequently, the identifier deployment may succeed but every release run and retry will fail while waiting for it after the release is already immutable; poll the run through an Actions-compatible API/command or use an authentication method that supports Checks.
Useful? React with 👍 / 👎.
| promotion_revision: ${{ steps.identity.outputs.promotion_revision }} | ||
| workflow_revision: ${{ steps.candidate.outputs.workflow_revision }} | ||
| docs_sha256: ${{ steps.candidate.outputs.docs_sha256 }} | ||
| identifier_catalog_sha256: ${{ steps.candidate.outputs.identifier_catalog_sha256 }} |
There was a problem hiding this comment.
The commit object for b573544b5b1e40d77cfe679a8fb57dc55d7dffe5 has no Signed-off-by: trailer, so this commit does not satisfy the repository's mandatory DCO policy; recreate or squash the change into a signed-off commit before merging.
AGENTS.md reference: AGENTS.md:L405-L407
Useful? React with 👍 / 👎.
| source is removed from the resolver. A current entry may update the metadata | ||
| for the same identifier, but neither the catalog nor the publisher may change | ||
| an identifier's kind or reuse it for a different meaning. | ||
| the active identifiers in that catalog. A previously published identifier |
There was a problem hiding this comment.
This change combines release automation under .github/workflows/ and release/ with the identifier product contract under products/identifiers/, contrary to the repository requirement that one change remain within one owning area; separate the product-contract update from the release-owned workflow and operational changes.
AGENTS.md reference: AGENTS.md:L413-L415
Useful? React with 👍 / 👎.
| | Candidate expires before the tag is pushed | Request and verify a new candidate | | ||
| | Bound draft or publication step fails while the candidate remains valid | Fix the workflow on protected `main` if needed, then rerun `registry-release publish --plan <candidate-plan.json> --wait` | | ||
| | Documentation dispatch or deployment fails after publication | Rerun `registry-release publish --plan <candidate-plan.json> --wait`; it verifies the immutable release and safely dispatches a new exact docs request when no healthy correlated run remains | | ||
| | Identifier dispatch, deployment, or live smoke fails after publication | Rerun `registry-release publish --plan <candidate-plan.json> --wait`; the already-public release takes the exact closeout path and republishes the same tag, source commit, and catalog digest. If the publisher bundle does not match, merge the reviewed synchronization for that exact released source before retrying. If it reports conflicting immutable bytes, stop and fix forward with a new release | |
There was a problem hiding this comment.
When identifier publication fails after the GitHub Release has become public, this prescribed rerun does not republish identifiers: publish_candidate_plan enters its already-published branch at release/scripts/registry-release:3574, verifies the public release, and only recovers documentation through line 3677, while dispatch_publication_run is reached only in the later unpublished branch. Thus an identifier dispatch, deployment, or smoke failure remains unrecoverable by the documented command; add explicit identifier recovery or redispatch the closeout workflow for this state.
Useful? React with 👍 / 👎.
| identifier_catalog_sha256="$( | ||
| git show \ | ||
| "${{ steps.identity.outputs.source_sha }}:products/identifiers/generated/catalog.v1.json" \ | ||
| | sha256sum | awk '{print $1}' | ||
| )" |
There was a problem hiding this comment.
When the maintained publication workflow is used for its accepted historical v0.19.0 case, this unconditional git show fails under set -euo pipefail because identifier catalogs begin at v0.19.1: IDENTIFIER_CATALOG_RELEASE_MINIMUM_VERSION is (0, 19, 1), and the v0.19.0 manifest has no catalog binding. This prevents even the already-published closeout path from reaching destination classification, so compute and publish the digest only for versions at or above the catalog minimum.
Useful? React with 👍 / 👎.
1 participant
Summary
Dependency
Depends on registrystack/registrystack-id#7. Merge that publisher PR first and configure
IDENTIFIER_PUBLISHER_TOKENwith Actions read/write access toregistrystack/registrystack-idbefore enabling this release path.Closes #636.
Verification
python3 -m unittest release/scripts/test_release_workflow_structure.py(53 passed)python3 -m unittest release/scripts/test_registry_release.py(94 passed)products/identifiers/scripts/check.sh(18 passed; catalog reproducible)actionlint .github/workflows/release.yml