mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-21 00:21:30 +00:00
5d670a530d
* ci(release): skip rc build on release PRs
Suppress the auto-fired Release Candidate workflow when:
1. The HEAD commit subject matches `chore: release vX.Y.Z` (the canonical
release-PR title), or
2. The squash-merged PR carries the `release` label.
Either match short-circuits the guard to should_run=false. This prevents the
rc cycle from racing publish.yml on the v-tag (as happened on v1.6.4 where
we had to manually cancel the auto-fired RC run after merging PR #1473).
Adds pull-requests: read to the guard job for the label lookup. A failed
gh API call falls through to the existing dedup logic rather than silently
suppressing rc builds.
* ci(release): address PR #1474 review — anchor regex + sanitise log echo
Two minor follow-ups from Claude's review:
1. End-anchor the release-subject regex. The previous shape
^chore: release vX.Y.Z would match noisy variants like
chore: release v1.0.0 (something unrelated). The new shape
requires either the bare title or the canonical squash-merge
(#NNNN) suffix exactly.
2. Sanitise HEAD_SUBJECT before echoing to logs. git %s strips
newlines so LF injection is impossible, but a hypothetical
subject containing ::error:: or ::set-output:: could otherwise
forge GitHub Actions annotation entries. Defence-in-depth.
Both findings flagged minor / does not block merge — applying
anyway since they are trivial.
|
||
|---|---|---|
| .. | ||
| ci-e2e.yml | ||
| ci-quality.yml | ||
| ci-report.yml | ||
| ci-scope-parity.yml | ||
| ci-tests.yml | ||
| ci.yml | ||
| claude.yml | ||
| codeql.yml | ||
| dependency-review.yml | ||
| docker.yml | ||
| gitleaks.yml | ||
| pr-autofix-apply.yml | ||
| pr-autofix-publish.yml | ||
| pr-autofix.yml | ||
| pr-description-check.yml | ||
| pr-labeler.yml | ||
| publish.yml | ||
| release-candidate.yml | ||
| scorecard.yml | ||
| tree-sitter-upgrade-readiness.yml | ||
| triage-sweep.yml | ||
| trivy.yml | ||
| workflow-lint.yml | ||