bread stable release workflow still clones into the shared src path #80

New issue

Open

opened 2026-10-16 18:54:56 +08:00 by Breadway · 1 comment

Breadway commented

2026-10-16 18:54:56 +08:00

Owner

Found during ECO-79 follow-up scope review of Bread workflows. The isolated Bread check and dev-release paths are covered by PR #49, but .forgejo/workflows/release.yml still runs rm -rf src && mkdir src and clones the mutable ref name into the shared workspace path.

Confidence: high that the workflow has the same unsafe fixed-path and branch-ref pattern by source inspection. The exact runner interleaving is not confirmed; no stable-release failure is attributed to it.

After ECO-79's shared checkout helper is reviewed and merged, update only Bread's stable release.yml in a separate fix branch/PR: fetch the helper from a pinned reviewed commit, verify its committed SHA-256 before execution, check out the event SHA into a per-job directory, export that path through GITHUB_ENV, and clean only that directory in a final always step. Keep existing package/artifact paths working without symlink mount conflicts.

Regression: local workflow fixture checks exact SHA and isolated path, plus a concurrent two-branch control. Run the relevant CI check. Do not batch other repos or workflows without their own cards.

Found during ECO-79 follow-up scope review of Bread workflows. The isolated Bread check and dev-release paths are covered by PR #49, but `.forgejo/workflows/release.yml` still runs `rm -rf src && mkdir src` and clones the mutable ref name into the shared workspace path. Confidence: high that the workflow has the same unsafe fixed-path and branch-ref pattern by source inspection. The exact runner interleaving is not confirmed; no stable-release failure is attributed to it. After ECO-79's shared checkout helper is reviewed and merged, update only Bread's stable `release.yml` in a separate fix branch/PR: fetch the helper from a pinned reviewed commit, verify its committed SHA-256 before execution, check out the event SHA into a per-job directory, export that path through GITHUB_ENV, and clean only that directory in a final always step. Keep existing package/artifact paths working without symlink mount conflicts. Regression: local workflow fixture checks exact SHA and isolated path, plus a concurrent two-branch control. Run the relevant CI check. Do not batch other repos or workflows without their own cards.

Breadway commented

2026-10-20 15:31:05 +08:00

Author

Owner

PR open: Breadway/bread#50 (fix/eco-81-release-isolated-checkout). Head SHA: 825120bd20a9d077b7dd6cda8cd89d59b71239e7. release.yml and rc-release.yml both moved to the per-job checkout; rc-release.yml had the same pattern and is included. Verified: YAML parses, bash -n on all run blocks, local fixture of the checkout/cleanup steps (exact SHA, concurrent jobs isolated, cleanup scoped). Not run: the real tag-triggered release workflows on the runner. The pinned-helper follow-up from the card is not done; inline bootstrap used as in check.yml/dev-release.yml.

PR open: https://git.breadway.dev/Breadway/bread/pulls/50 (fix/eco-81-release-isolated-checkout). Head SHA: 825120bd20a9d077b7dd6cda8cd89d59b71239e7. release.yml and rc-release.yml both moved to the per-job checkout; rc-release.yml had the same pattern and is included. Verified: YAML parses, bash -n on all run blocks, local fixture of the checkout/cleanup steps (exact SHA, concurrent jobs isolated, cleanup scoped). Not run: the real tag-triggered release workflows on the runner. The pinned-helper follow-up from the card is not done; inline bootstrap used as in check.yml/dev-release.yml.