Breadway/bread
1
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

ci(release): check out the event sha into a per-job directory (release and rc-release) #50

Open
Breadway wants to merge 1 commit from fix/eco-81-release-isolated-checkout into main
pull from: fix/eco-81-release-isolated-checkout
merge into: Breadway:main
Conversation 0 Commits 1 Files changed 2 +76 -24
Breadway commented 2026-10-20 15:30:23 +08:00
Owner
Copy link

Found by: ECO-81 card (bread stable release workflow still clones into the shared src path). Same class as ECO-79, which fixed check.yml and dev-release.yml in PR #49.

What changed

  • .forgejo/workflows/release.yml (stable v* tags): the checkout step no longer runs rm -rf src && mkdir src and clones the tag name into the shared workspace. It now uses the same inline bootstrap as check.yml and dev-release.yml, which mirrors bread-ecosystem scripts/ci-checkout.sh (merged at c6442cab):
    • verifies GITHUB_SHA is a full 40-hex commit id
    • mktemp -d a per-job directory under RUNNER_TEMP
    • exports BREAD_CI_JOB_DIR through GITHUB_ENV
    • git clone --no-checkout, detaches at GITHUB_SHA, and verifies HEAD equals it
  • Every later src reference (build, test, publish debug symbols, prepare artifacts) now reads from "$BREAD_CI_JOB_DIR/src".
  • A final if: always() step clean owned checkout removes only that directory, and only when it matches ${RUNNER_TEMP}/bread-ci.*.
  • .forgejo/workflows/rc-release.yml (vX.Y.Z-rc.N tags): same change, since it has the identical rm -rf src pattern. Included in this PR as the card asked us to check it.

Unchanged: version computation (from the tag), artifact paths under /srv/breadway-dl (stable and beta), strip and sha256 steps, minisign index regeneration, and the gh release create/upload step.

Tag events

Tags in this repo are lightweight (git cat-file -t v0.9.0-rc.1 reports commit), so GITHUB_SHA on a tag push is the tagged commit and the HEAD == GITHUB_SHA check holds. The local fixture also confirmed this for a lightweight tag.

Deviation from the card

The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, as check.yml and dev-release.yml do, so the three workflows stay identical. Replacing it with a pinned fetch plus hash check is a follow-up.

How verified

  • python3 -c 'import yaml; yaml.safe_load(...)' passes for release.yml, rc-release.yml, check.yml, and dev-release.yml.
  • bash -n passes for every run: block in release.yml and rc-release.yml.
  • Grep for src shows no bare cd src, src/, or rm -rf src left. The only remaining src tokens are the "$checkout/src" clone and checkout lines, which are intended.
  • Local fixture (not committed): ran the edited checkout and cleanup step text against a local bare repo with two commits. Results: exact SHA at HEAD for both jobs; two concurrent jobs on different SHAs got distinct directories and neither changed the other; cleanup removed only its own directory; a non-40-hex GITHUB_SHA is rejected; a lightweight tag at the event SHA checks out correctly.

Not run

  • The real release.yml and rc-release.yml on the self-hosted runner. They only run on tag pushes, and this PR does not push tags or trigger releases.
  • The concurrent control reproducing the old shared-path race, which the card suggests. The fixture covers the new path only.
  • Any /srv/breadway-dl write or gh upload.

Refs ECO-81

Found by: ECO-81 card (bread stable release workflow still clones into the shared src path). Same class as ECO-79, which fixed check.yml and dev-release.yml in PR #49. ## What changed - `.forgejo/workflows/release.yml` (stable `v*` tags): the checkout step no longer runs `rm -rf src && mkdir src` and clones the tag name into the shared workspace. It now uses the same inline bootstrap as `check.yml` and `dev-release.yml`, which mirrors bread-ecosystem `scripts/ci-checkout.sh` (merged at c6442cab): - verifies `GITHUB_SHA` is a full 40-hex commit id - `mktemp -d` a per-job directory under `RUNNER_TEMP` - exports `BREAD_CI_JOB_DIR` through `GITHUB_ENV` - `git clone --no-checkout`, detaches at `GITHUB_SHA`, and verifies HEAD equals it - Every later `src` reference (build, test, publish debug symbols, prepare artifacts) now reads from `"$BREAD_CI_JOB_DIR/src"`. - A final `if: always()` step `clean owned checkout` removes only that directory, and only when it matches `${RUNNER_TEMP}/bread-ci.*`. - `.forgejo/workflows/rc-release.yml` (`vX.Y.Z-rc.N` tags): same change, since it has the identical `rm -rf src` pattern. Included in this PR as the card asked us to check it. Unchanged: version computation (from the tag), artifact paths under `/srv/breadway-dl` (stable and beta), strip and sha256 steps, minisign index regeneration, and the `gh release create/upload` step. ## Tag events Tags in this repo are lightweight (`git cat-file -t v0.9.0-rc.1` reports `commit`), so `GITHUB_SHA` on a tag push is the tagged commit and the `HEAD == GITHUB_SHA` check holds. The local fixture also confirmed this for a lightweight tag. ## Deviation from the card The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, as `check.yml` and `dev-release.yml` do, so the three workflows stay identical. Replacing it with a pinned fetch plus hash check is a follow-up. ## How verified - `python3 -c 'import yaml; yaml.safe_load(...)'` passes for `release.yml`, `rc-release.yml`, `check.yml`, and `dev-release.yml`. - `bash -n` passes for every `run:` block in `release.yml` and `rc-release.yml`. - Grep for `src` shows no bare `cd src`, `src/`, or `rm -rf src` left. The only remaining `src` tokens are the `"$checkout/src"` clone and checkout lines, which are intended. - Local fixture (not committed): ran the edited checkout and cleanup step text against a local bare repo with two commits. Results: exact SHA at HEAD for both jobs; two concurrent jobs on different SHAs got distinct directories and neither changed the other; cleanup removed only its own directory; a non-40-hex `GITHUB_SHA` is rejected; a lightweight tag at the event SHA checks out correctly. ## Not run - The real `release.yml` and `rc-release.yml` on the self-hosted runner. They only run on tag pushes, and this PR does not push tags or trigger releases. - The concurrent control reproducing the old shared-path race, which the card suggests. The fixture covers the new path only. - Any `/srv/breadway-dl` write or gh upload. Refs ECO-81
ci(release): check out the event sha into a per-job directory
Some checks failed
check / check (push) Failing after 1m6s
Details
825120bd20 
release.yml and rc-release.yml ran `rm -rf src && mkdir src` and cloned
the mutable tag name into the shared workspace path. Concurrent jobs on
the shared self-hosted runner can replace the tree under a running
build (ECO-79).

Both workflows now use the same inline bootstrap as check.yml and
dev-release.yml, mirroring bread-ecosystem scripts/ci-checkout.sh
(merged at c6442cab):

- verify GITHUB_SHA is a full 40-hex commit id
- mktemp a per-job directory under RUNNER_TEMP
- export BREAD_CI_JOB_DIR through GITHUB_ENV
- clone --no-checkout and detach at GITHUB_SHA, then verify HEAD

Later steps read from "$BREAD_CI_JOB_DIR/src". A final always step
removes only that directory, and only under RUNNER_TEMP.

Version computation, artifact paths under /srv/breadway-dl, signing,
and gh release upload are unchanged.

Refs ECO-81
Some checks failed
check / check (push) Failing after 1m6s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/eco-81-release-isolated-checkout:fix/eco-81-release-isolated-checkout
git switch fix/eco-81-release-isolated-checkout

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff fix/eco-81-release-isolated-checkout
git switch fix/eco-81-release-isolated-checkout
git rebase main
git switch main
git merge --ff-only fix/eco-81-release-isolated-checkout
git switch fix/eco-81-release-isolated-checkout
git rebase main
git switch main
git merge --no-ff fix/eco-81-release-isolated-checkout
git switch main
git merge --squash fix/eco-81-release-isolated-checkout
git switch main
git merge --ff-only fix/eco-81-release-isolated-checkout
git switch main
git merge fix/eco-81-release-isolated-checkout
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breadbug

   
bug

   
phase-1

   
phase-2

   
privacy
No labels
breadbug
bug
phase-1
phase-2
privacy
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bread!50
No description provided.