Skip to content

fix(#2420): automate v0 floating tag move in release workflow #2421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rh-hemartin wants to merge 1 commit into
base: main
Choose a base branch
from
+35 −23
Open

fix(#2420): automate v0 floating tag move in release workflow #2421

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,22 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}

- name: Move v0 floating tag

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] shell-error-handling

The new shell script in the Move v0 floating tag step does not use set -euo pipefail. All other multi-line run: blocks across the repository workflows consistently use it. Without set -e, a failed git tag -f would silently continue to git push with stale state.

Suggested fix: Add set -euo pipefail as the first line of the run: block.

@fullsend-ai-review fullsend-ai-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] missing-authorization

The automated v0 tag move removes a human confirmation checkpoint (AskUserQuestion) from SKILL.md step 8. The semver tag push itself serves as the authorization gate.

if: "!contains(github.ref_name, '-')"
run: |
set -euo pipefail
CURRENT=""
if git rev-parse v0 >/dev/null 2>&1; then
CURRENT=$(git rev-parse v0)

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] race-condition

The ancestry guard checks v0 position then force-pushes in a separate git operation. A concurrent release could move v0 between check and push. Practical risk is negligible since releases are manual and sequential.

Suggested fix: Replace git push origin v0 --force with git push --force-with-lease=v0: origin v0.

if ! git merge-base --is-ancestor "${CURRENT}" "${GITHUB_SHA}"; then
echo "::warning::v0 already points at a newer commit, skipping"

@fullsend-ai-review fullsend-ai-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] error-message-style

The ::warning:: message could include the current v0 SHA (${CURRENT}) and ${GITHUB_SHA} for easier debugging when the ancestry check skips the v0 move.

exit 0
fi
fi
git tag -f v0 "${GITHUB_SHA}"

@fullsend-ai-review fullsend-ai-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] race-condition

The --force-with-lease push is an atomic server-side check, so concurrent releases fail safely. However, there is no retry mechanism, so v0 would remain not updated on failure. Practical risk is very low.

if [[ -n "${CURRENT}" ]]; then
git push --force-with-lease="v0:${CURRENT}" origin v0
else
git push origin v0
fi
8 changes: 8 additions & 0 deletions .goreleaser.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
version: 2

git:
# Ignore major-version floating tags (v0, v1, ...) so they don't
# confuse GoReleaser's previous-tag detection for changelogs.
ignore_tags:
- v0
Comment thread
rh-hemartin marked this conversation as resolved.
- v1
- v2

builds:
- main: ./cmd/fullsend/
binary: fullsend
Expand Down
24 changes: 4 additions & 20 deletions skills/cutting-releases/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,29 +109,12 @@ GoReleaser takes over from here. Verify the workflow starts:
gh run list --workflow=release.yml --limit=1
```

### 8. Move the `v0` tag

Downstream orgs reference reusable workflows via `@v0`. Use
`AskUserQuestion` to confirm before force-pushing:

> About to force-push `v0` to `<tag>`. This immediately changes what
> all downstream `@v0` consumers resolve. Proceed?

Once confirmed:

```
git tag -f v0 <tag>
git push origin v0 --force
```

The Sandbox Images workflow (triggered by tag push) will also run.

### 9. Run post-flight verification
### 8. Run post-flight verification

Read [post-flight.md](post-flight.md) in this skill's directory and
follow the post-flight verification procedure.

### 10. Install the binary locally
### 9. Install the binary locally

Use `AskUserQuestion` to ask where to install (default: `~/.local/bin/`),
then run the install script using its repo-root-relative path:
Expand All @@ -150,4 +133,5 @@ installs the binary as `fullsend-<tag>` so multiple versions can coexist.
- **Never delete a published tag.** If a release is bad, cut a new patch or RC.
- **The changelog** is auto-generated from conventional commit prefixes.
- **The `v0` tag** is a moving tag consumed by downstream orgs for reusable
workflows. Always move it as part of the release process (step 8).
workflows. It is automatically moved by the release workflow after
GoReleaser completes (skipped for pre-release tags).
7 changes: 4 additions & 3 deletions skills/cutting-releases/post-flight.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,15 @@

Part of the [cutting-releases](SKILL.md) skill.

Run after the version tag is pushed, the `v0` tag is moved, and the
CI workflows complete. Focus on the areas identified during pre-flight
Run after the version tag is pushed and the CI workflows complete.
Comment thread
rh-hemartin marked this conversation as resolved.
The release workflow automatically moves the `v0` floating tag after
GoReleaser succeeds (skipped for pre-release tags). Focus on the areas identified during pre-flight
step F.

## A. Wait for CI workflows

Wait for the Release workflow (triggered by the `v*` tag) and the

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] documentation-accuracy

The Sandbox Images trigger description says triggered by release workflow but sandbox-images.yml is triggered by a tag push matching v[0-9]+.[0-9]+* (the semver version tag), not by the release workflow.

Suggested fix: Change the parenthetical to (triggered by the version tag push).

@fullsend-ai-review fullsend-ai-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] documentation-code-mismatch

The diff changes the Sandbox Images workflow trigger description to 'triggered by release workflow', but sandbox-images.yml triggers on semver tag pushes matching v[0-9]+.[0-9]+*, not by the release workflow. The old text was also inaccurate.

Suggested fix: Change the parenthetical to '(triggered by the semver tag push)'.

Sandbox Images workflow (triggered by the `v0` tag move) to complete:
Sandbox Images workflow (triggered by release workflow) to complete:

```
gh run list --workflow=release.yml --limit=1
Expand Down
Loading