From d33af8977d545e8637c7aa3b899d25d889c436f9 Mon Sep 17 00:00:00 2001 From: Danius Kalvaitis Date: Fri, 12 Jun 2026 15:40:28 +0300 Subject: [PATCH] release.sh: Block on non-green CI No override flag - a release requires a green run on the packaging tip. An unreachable API blocks too: releasing blind is the same risk as releasing red. Dry runs report and continue. Signed-off-by: Danius Kalvaitis --- debian/source/README.source | 5 +++-- release.sh | 24 +++++++++++++++--------- 2 files changed, 18 insertions(+), 11 deletions(-) diff --git a/debian/source/README.source b/debian/source/README.source index 9dbd0d8f9..32d5e4327 100644 --- a/debian/source/README.source +++ b/debian/source/README.source @@ -106,8 +106,9 @@ the packaging tag moves. To release, run `./release.sh` from this branch (use `--dry-run` to preview). It derives both tag names from `debian/changelog` on the remote packaging tip, reuses the source tag on packaging-only -rebuilds and pushes both tags atomically. The packaging-tag push -triggers `.github/workflows/release.yml`. +rebuilds, refuses to tag unless the branch's latest CI run is green +and pushes both tags atomically. The packaging-tag push triggers +`.github/workflows/release.yml`. Manual equivalent (what the script automates): diff --git a/release.sh b/release.sh index f65356843..43925b7bd 100755 --- a/release.sh +++ b/release.sh @@ -59,18 +59,24 @@ echo "Release: ${FULL}" echo "Source tag: ${SRC_TAG} -> ${SRC_SHA} (${SRC_NOTE})" echo "Packaging tag: ${PKG_TAG} -> ${PKG_SHA} (${REMOTE}/${PKG_BRANCH})" -# Warn (never block) if the packaging tip is not CI-green. -if command -v python3 >/dev/null 2>&1; then - BRANCH_ENC=$(printf %s "$PKG_BRANCH" | sed 's#/#%2F#g') - CONCLUSION=$(curl -sf --max-time 10 \ - "https://api.github.com/repos/${REPO}/actions/runs?branch=${BRANCH_ENC}&per_page=1" \ - 2>/dev/null \ - | python3 -c 'import json,sys +# Block unless the packaging tip is CI-green (dry runs only +# report). An unreachable API blocks too: releasing blind is the +# same risk as releasing red. +BRANCH_ENC=$(printf %s "$PKG_BRANCH" | sed 's#/#%2F#g') +CONCLUSION=$(curl -sf --max-time 10 \ + "https://api.github.com/repos/${REPO}/actions/runs?branch=${BRANCH_ENC}&per_page=1" \ + 2>/dev/null \ + | python3 -c 'import json,sys r = json.load(sys.stdin)["workflow_runs"] print(r[0]["conclusion"] or "in_progress" if r else "none")' \ - 2>/dev/null) || CONCLUSION=unknown - if [ "$CONCLUSION" != "success" ]; then + 2>/dev/null) || CONCLUSION=unknown +if [ "$CONCLUSION" != "success" ]; then + if [ "$DRY" -eq 1 ]; then echo "WARNING: latest CI on ${PKG_BRANCH} is '${CONCLUSION}', not 'success'." + else + echo "ERROR: latest CI on ${PKG_BRANCH} is '${CONCLUSION}', not 'success'." >&2 + echo " Wait for a green run on the packaging tip." >&2 + exit 1 fi fi