From a6cbbedb482e7cb4f624c1bcbfcd150cfaee1849 Mon Sep 17 00:00:00 2001 From: Felipe Rosa Date: Wed, 16 Sep 2026 12:37:53 +0000 Subject: [PATCH] docs(genie): replace the dead v4 release recovery section with the real rules Co-Authored-By: Claude Fable 5.1 --- genie/_internal/runbooks/release-pipeline.md | 34 ++++++++++++-------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/genie/_internal/runbooks/release-pipeline.md b/genie/_internal/runbooks/release-pipeline.md index 143b45a..99258e0 100644 --- a/genie/_internal/runbooks/release-pipeline.md +++ b/genie/_internal/runbooks/release-pipeline.md @@ -17,24 +17,30 @@ gh run view --log "$RUN_ID" ## Recovery -If build succeeded but sign-attest failed, dispatch the per-file escape hatch. +There is no per-file escape hatch. `sign-attest.yml` and `release-publish.yml` are `workflow_call`-only — they run as jobs inside one release attempt and cannot be dispatched with an external run id. As `release-publish.yml` puts it: "All artifacts are from one workflow run; there is no standalone dispatch or external run-id recovery path." + +### Transient failure inside one release attempt + +Re-run the failed jobs of that same run: ```bash -RUN_ID=12345 # paste the build-tarballs run id -gh workflow run sign-attest.yml \ - --field version=4.260510.6 \ - --field run_id="$RUN_ID" +gh run rerun --failed ``` -After sign-attest succeeds, dispatch publish with its run id. +Prefer re-running the whole run over a partial re-run. Every artifact's endorsement carries the signer run that produced it, and the stable security gate requires them all to agree; artifacts mixed across attempts fail the gate with `verified signer run disagreement`. + +### A dev release whose tag is already pushed + +It cannot be republished. `version.yml` derives a fresh build number from the existing `v5..*` tags, pushes the version commit and the new tag with one `git push --atomic`, and only calls `release.yml` after that push succeeds. A re-run re-derives against the tag that now exists, so the atomic push is rejected and the run stops at: -```bash -SIGN_RUN=12345 # paste the sign-attest run id -gh workflow run release-publish.yml \ - --field version=4.260510.6 \ - --field run_id="$SIGN_RUN" \ - --field channel=stable \ - --field draft=false ``` +release-race.next-tag-pin-skipped.detected +``` + +The remedy is to land any commit on `dev` through a normal PR — the next green CI run allocates the next build number and publishes it. The orphan tag is already acknowledged by the Release Orphan Alert issue; do not try to re-dispatch that version. + +### Stable + +Stable is never auto-dispatched. After the promotion PR merges, `version.yml` pushes the fresh promotion tag and writes the `release.yml` inputs into the run summary (`version`, `channel: stable`, `source_sha`, `source_branch: main`, `source_ci_run_id`). A maintainer then opens **Actions → Release → Run workflow** on `main` and supplies them; manual dispatch offers `stable` as the only channel. A different maintainer must approve the protected `production` environment — the initiator cannot. -If the orchestrator never fires, check that `version.yml` dispatched it. +If the orchestrator never fires at all, check that `version.yml` reached its release job.