From d26bede28edfa6b7c08eb488e0d7b1dd84841af1 Mon Sep 17 00:00:00 2001 From: Matee ullah Malik Date: Thu, 2 Jul 2026 23:14:17 +0000 Subject: [PATCH] ci(release): fold deploy-intent check into tag_info step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #303. The env-based approach in that PR triggered a GHA startup failure (workflow accepted, 0 jobs scheduled, run completed in the same second with conclusion=failure) because a step-level `env:` value cannot safely carry the multi-line `tag_message` output — GHA rejects the workflow at dispatch time. Verified failure signature on 8eae29e: run 28627254564 / 28627293599 — status=completed, conclusion=failure, jobs=[], run_started_at == updated_at (single-second dispatch reject). Fix: perform the `[no-deploy]` grep INSIDE the `Get tag information` step, where `$TAG_MESSAGE` already exists as a plain bash variable. Export the single-line `draft` boolean from the same step. The multi-line `tag_message` output is preserved (still consumed by the release-body heredoc, which is safe because it uses `<<'EOT'`). Update the two downstream references from steps.deploy_check.outputs.draft to steps.tag_info.outputs.draft. Root cause and reasoning preserved as an inline comment. Signed-off-by: Matee ullah Malik --- .github/workflows/build&release.yml | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build&release.yml b/.github/workflows/build&release.yml index 1a8c14c0..97886754 100644 --- a/.github/workflows/build&release.yml +++ b/.github/workflows/build&release.yml @@ -72,17 +72,16 @@ jobs: echo "GHOEOF" } >> "$GITHUB_OUTPUT" - - name: Check deploy intent - id: deploy_check - env: - TAG_MSG: ${{ steps.tag_info.outputs.tag_message }} - run: | - # NOTE: TAG_MSG is passed via env: (not ${{ }} inlined into the script) - # because the tag/commit message is multi-line and may contain shell - # metacharacters or command names (e.g. "deadcode"). Inlining it would - # let those lines execute as bash and abort the release job with exit - # 127. See build&release.yml history / v2.6.0-testnet post-mortem. - if printf '%s' "$TAG_MSG" | grep -qi '\[no-deploy\]'; then + # Deploy-intent check runs HERE (not in a separate step) because + # step-level `env:` values cannot safely carry the multi-line + # tag_message output — GHA rejects such workflows with a startup + # failure (0 jobs, run_attempt=1 completed instantly). Doing the + # check inline keeps the raw message inside a bash variable and + # only exports the single-line `draft` boolean to downstream steps. + # Prior implementation inlined the message via ${{ }} interpolation, + # which let commit-body tokens (e.g. "deadcode") execute as bash + # and killed v2.6.0-testnet with exit 127. See PR history. + if printf '%s' "$TAG_MESSAGE" | grep -qi '\[no-deploy\]'; then echo "draft=true" >> "$GITHUB_OUTPUT" echo "⚠️ [no-deploy] detected — release will be created as DRAFT" else @@ -222,7 +221,7 @@ jobs: if: success() && steps.rel_check.outputs.exists != 'true' with: tag_name: ${{ steps.tag_info.outputs.tag_name }} - draft: ${{ steps.deploy_check.outputs.draft == 'true' }} + draft: ${{ steps.tag_info.outputs.draft == 'true' }} files: | release/${{ steps.vars.outputs.binary_name }}.tar.gz release/${{ steps.vars.outputs.binary_name }} @@ -234,7 +233,7 @@ jobs: if: success() && steps.rel_check.outputs.exists == 'true' with: tag_name: ${{ steps.tag_info.outputs.tag_name }} - draft: ${{ steps.deploy_check.outputs.draft == 'true' }} + draft: ${{ steps.tag_info.outputs.draft == 'true' }} files: | release/${{ steps.vars.outputs.binary_name }}.tar.gz release/${{ steps.vars.outputs.binary_name }}