feat(release): add guarded Action tag recovery - #175
Merged
Conversation
Add a least-privilege manual recovery workflow, lease-protected tag movement, annotated-release guards, operational documentation, and targeted contracts for the moving major Action tag. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
Decisions governing this change
|
There was a problem hiding this comment.
🟡 Changes recommended
The manual fallback omits bundle guards, and lease race behavior lacks a regression test.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds guarded recovery for the moving major Action tag.
Changes:
- Adds lease-protected forward and recovery tag movement.
- Adds a least-privilege recovery workflow and tests.
- Documents recovery and containment procedures.
File summaries
| File | Description |
|---|---|
.github/workflows/action-tag-recovery.yml |
Adds guarded recovery workflow. |
.github/workflows/release.yml |
Records tag promotion summaries. |
scripts/update-action-tag.ts |
Adds recovery and lease protection. |
scripts/update-action-tag.test.ts |
Tests backward recovery. |
scripts/action-tag-recovery-contract.test.ts |
Verifies workflow contracts. |
docs/RELEASING.md |
Adds recovery runbook. |
docs/DISTRIBUTION.md |
Documents distribution recovery. |
AGENTS.md |
Records recovery constraints. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| [ | ||
| 'git', | ||
| 'push', | ||
| `--force-with-lease=refs/tags/${majorTag}:${remoteRefSha ?? ''}`, |
Comment on lines
+455
to
+457
| test "$(git cat-file -t "refs/tags/$target")" = tag | ||
| target_commit=$(git rev-parse "$target^{commit}") | ||
| git merge-base --is-ancestor "$target_commit" origin/main |
Add a durable withdrawal marker, preserve the observed remote lease during recovery, and reject withdrawn reruns before publication. Bring manual recovery checks and negative coverage in line with the guarded workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
Fail closed on withdrawal-marker lookup errors and bind successful Release runs to the requested lockstep tag. Extend the manual fallback and collision regressions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com Signed-off-by: Mark Beacom <m@beacom.dev>
Make marker creation safe under signed-tag defaults and preserve explicit empty remote leases for absent v0 creation. Add executable regressions for CAS races and recovery validation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
Ensure the manual fallback enables fail-fast mode before marker creation and test the extracted fallback block instead of matching the preferred workflow example. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com Signed-off-by: Mark Beacom <m@beacom.dev>
Anchor manual recovery coverage to the complete marker creation and push sequence, rejecting missing, masked, or post-recovery pushes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
mbeacom
added
the
gate-change-acknowledged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow_dispatchrecovery path that runs only frommain, accepts only an existing successful stable lockstep release, peels the annotated version tag to its commit, and verifies both committed Action bundles--recoverfor backward movement; record forward and recovery movement in workflow summariesRecovery semantics
Moving
v0stops new jobs from resolving a bad release. It does not change jobs that already resolved the old SHA and does not restore comments already edited by completed runs; those require GitHub edit history or a known-good rerun. The guarded workflow uses onlyactions: readandcontents: write, validates the exact successful release-run SHA, and fails rather than overwriting a concurrent tag move.Validation
bun run typecheckbun run lintbun test(2,649 passed, 1 skipped)actionlint .github/workflows/action-tag-recovery.yml .github/workflows/release.ymlReleaserun did not succeedv0remains at v0.11.0Closes #136
Closes #122
Related: #104 was separately verified fixed in v0.11.0 and closed.