Skip to content

Fix Docker publish release recovery #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abmmhasan merged 3 commits into from
Sep 17, 2026
Merged

Fix Docker publish release recovery #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
91b7dd7
test: cover release publish recovery
abmmhasan Sep 17, 2026
ac07d29
fix: add release publish recovery path
abmmhasan Sep 17, 2026
425f8e6
test: fix release recovery shellcheck
abmmhasan Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/docker.publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ on:
schedule:
- cron: '0 0 * * 0'
workflow_dispatch:
inputs:
release_tag:
description: 'Published release tag to recover; leave empty to refresh latest only'
required: false
type: string

concurrency:
group: docker-publish
Expand Down Expand Up @@ -36,6 +41,7 @@ jobs:
EVENT_RELEASE_TAG: ${{ github.event.release.tag_name }}
EVENT_RELEASE_DRAFT: ${{ github.event.release.draft }}
EVENT_RELEASE_PRERELEASE: ${{ github.event.release.prerelease }}
MANUAL_RELEASE_TAG: ${{ inputs.release_tag }}
run: |
set -euo pipefail

Expand All @@ -45,6 +51,23 @@ jobs:
exit 1
fi
RELEASE_TAG="$EVENT_RELEASE_TAG"
PUBLISH_RELEASE_TAG=true
VERIFY_TAG="$RELEASE_TAG"
elif [[ "$EVENT_NAME" == workflow_dispatch && -n "$MANUAL_RELEASE_TAG" ]]; then
release_json="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${MANUAL_RELEASE_TAG}")"
RELEASE_TAG="$(jq -r '.tag_name // empty' <<<"$release_json")"
release_draft="$(jq -r '.draft' <<<"$release_json")"
release_prerelease="$(jq -r '.prerelease' <<<"$release_json")"

[[ "$RELEASE_TAG" == "$MANUAL_RELEASE_TAG" ]] || {
echo "Published release tag could not be resolved: $MANUAL_RELEASE_TAG" >&2
exit 1
}
[[ "$release_draft" == false && "$release_prerelease" == false ]] || {
echo "Manual recovery refuses draft/prerelease release: $MANUAL_RELEASE_TAG" >&2
exit 1
}

PUBLISH_RELEASE_TAG=true
VERIFY_TAG="$RELEASE_TAG"
else
Expand All @@ -71,6 +94,14 @@ jobs:
echo "VERIFY_TAG=$VERIFY_TAG"
} >> "$GITHUB_ENV"

{
echo '## Publish resolution'
echo
echo "- Event: \`$EVENT_NAME\`"
echo "- Apache source release: \`$RELEASE_TAG\`"
echo "- Publish immutable release tag: \`$PUBLISH_RELEASE_TAG\`"
} >> "$GITHUB_STEP_SUMMARY"

- name: Check out exact release source
uses: actions/checkout@v7
with:
Expand Down
4 changes: 4 additions & 0 deletions tests/release-contract.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ for contract in \
'docker/metadata-action@v6' \
'docker/build-push-action@v7' \
'actions/attest@v4' \
'release_tag:' \
'MANUAL_RELEASE_TAG' \
"releases/tags/\${MANUAL_RELEASE_TAG}" \
'PUBLISH_RELEASE_TAG' \
'Enforce immutable release tags' \
'linux/amd64,linux/arm64' \
Expand All @@ -20,6 +23,7 @@ for contract in \
done

grep -Fq "cron: '0 0 * * 0'" "$workflow"
grep -Fq 'types: [published]' "$workflow"

if grep -Fq 'actions/checkout@v4' "$workflow"; then
echo 'Legacy checkout action detected.' >&2
Expand Down