CalvinBackup/gstack
1
0 Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-11-05 08:23:59 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(release-gate): a missing report artifact or a sha-less failure fails closed (GST-1263) (#3982)

Browse Source 
* fix(release-gate): a missing report artifact or a sha-less failure fails closed (GST-1263)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: pre-landing review fixes

Review-Finding: p1/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
This commit is contained in:
Garry Tanandcapy-ai[bot] authored and GitHub committed 2026-11-04 02:58:09 +00:00
1 parent 526f604f91
commit 69f0fe181a
6 files changed
+66 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/release-gate.yml
+4 -3
View File
@@ -84,14 +84,15 @@ jobs:
GSTACK_STATE_ROOT: ${{ runner.temp }}/gstack-state
DRY_RUN: ${{ inputs.dry_run && '1' || '' }}
IGNORE_CADENCE: ${{ inputs.ignore_cadence && '1' || '' }}
# held and failed are verdicts the release-check job publishes on the gated commit. Failing this job would
# held and failed on a gated commit are verdicts the release-check job publishes there. Failing this job would
# leave a failed check on main's head, which release-cut reads as red even after that head gates green, so
# only a run that recorded no action (a crash) fails it.
# those leave it green. A failure with no gated commit (a refused policy, unreadable notes, an unresolved
# branch) publishes no check run, so it fails the job, as does a run that recorded no action (a crash).
run: |
rc=0
./bin/gstack-release-gate run --repo "$GITHUB_REPOSITORY" --budget-minutes 330 \
--summary "$GITHUB_STEP_SUMMARY" --outputs "$GITHUB_OUTPUT" ${DRY_RUN:+--dry-run} ${IGNORE_CADENCE:+--ignore-cadence} || rc=$?
if [ "$rc" != 0 ] && ! grep -qE '^action=(held|failed)$' "$GITHUB_OUTPUT"; then exit "$rc"; fi
if [ "$rc" != 0 ] && ! { grep -qE '^action=(held|failed)$' "$GITHUB_OUTPUT" && grep -qE '^sha=[0-9a-f]{40}$' "$GITHUB_OUTPUT"; }; then exit "$rc"; fi
# The gated commit's check run (release_gate.check_name, main-backstop), the
# evidence scripts/release-cut.ts reads. Its own job with checks: write and