fix: make identifier publication release-owned - #7
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f41901c3c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| push: | ||
| branches: [main] | ||
| workflow_dispatch: | ||
| inputs: |
There was a problem hiding this comment.
When this workflow is dispatched with a non-main ref, the checkout and subsequent build use the publisher files from that ref, but no condition verifies github.ref. Because workflow_dispatch permits selecting a branch, a write-capable caller can deploy an unreviewed feature-branch bundle with the production Cloudflare credentials despite the new reviewed-main publication model; reject any ref other than refs/heads/main before the deploy job runs.
Useful? React with 👍 / 👎.
| python3 -m http.server 8765 --directory public >"${RUNNER_TEMP}/identifier-server.log" 2>&1 & | ||
| server_pid="$!" | ||
| trap 'kill "${server_pid}"' EXIT | ||
| IDENTIFIER_BASE_URL=http://127.0.0.1:8765 npm run smoke:catalog |
There was a problem hiding this comment.
When Python has not finished binding port 8765 before this newly added command starts, smoke:catalog immediately launches eight workers and permanently records their connection failures instead of retrying. This is reproducible with the workflow's command sequence—the smoke reported 68 of 320 failed requests while the server became ready during the run—so otherwise valid CI runs can fail; poll a known route or add retry handling before starting the smoke.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1 participant
Summary
Dependency
Companion publisher change for registrystack/registry-stack#636. The Registry Stack release workflow PR will dispatch this workflow and wait for its correlated deployment.
Pinned release source:
22ea92286036f28a59cfbe5d7c835f4738d62074(v0.32.0)Catalog SHA-256:
2be0b75f9d9e56451af9785fbf73284806f40ab70bf2a1c85f3a612d871510d1Verification
npm testnpm run check:upstream -- <v0.32.0 checkout>actionlint .github/workflows/*.ymlsmoke:catalog: 296 identifiers and 24 retained immutable artifactssmoke:live