Repository navigation
release.yml: same-revision CI gate, timeouts, environment coverage, latest promotion guard #985
Description
Follow-up from wrightkit/.github#49 audit (docs/ci-release-audit-2026-10.md, W-P2).
Problem
release-identityverifies tag↔commit↔version but encodes no same-revision CI gate; only the nightly path is CI-gated viaworkflow_runsuccess (release.yml:36–39). Stable publication relies on Release-PR merge protection, invisible in the workflow.- No
timeout-minuteson any job inrelease.ymlorrelease-please.yml(rust-ci.md rule 7). publish-r2,advance-latest,publish-taphold R2/GH_TOKENsecrets withoutenvironment: release(onlypublish-release/publish-npmuse it).- Per-tag concurrency groups (
wright-<tag>) do not serialize across tags; two stable runs can interleavepublish-r2/publish-release --latest/advance-latestand regresslatest(R2 pointer or GitHub-latest). - Edge: if the Release already exists as public (not draft),
publish-releaselogs and uploads nothing — a silently empty release.
Desired behavior
release-identity(or an equivalent early job) asserts the required check-runs succeeded forRELEASE_COMMITbefore any publish job runs.timeout-minuteson every job.- R2/token-bearing publish jobs run in the
releaseenvironment. latestpromotion is serialized per repository or version-monotonic so an older tag cannot overwrite a newer release.- The existing-public-release edge fails loudly instead of shipping an empty release.
Acceptance criteria
- Stable publication refuses when the tagged revision's required checks have not succeeded.
- Every job carries
timeout-minutes. -
publish-r2/advance-latest/publish-taprun inenvironment: release. - Concurrent stable runs cannot regress
latest. - Pre-existing public release is an explicit failure, not a silent no-op.
Evidence
Audit wright release findings with line citations in docs/ci-release-audit-2026-10.md.
Activity
e54-bot commentedon Oct 24, 2026
Implementation delivered in #989 (approve after review round 2; all CI checks green). The remaining action is the required CODEOWNERS review on
.github/workflows/— same owner gate as #988.What the PR implements, per the acceptance criteria:
release-identitygained a stable-onlyRequire CI success on the release revisionstep polling theCI resultaggregate check-run onRELEASE_COMMIT(fails closed on missing/non-success/API error, 90-minute window).wright-stableconcurrency group; aGuard latest promotion orderstep refuses a tag older than the publishedwright/latest/versionpointer (equal versions pass for idempotent re-runs).timeout-minuteson all 11 jobs inrelease.yml+ therelease-pleasejob.environment: releaseadded topublish-r2,advance-latest,publish-tap(all five secret-bearing publish jobs now use it;publish-r2also covers nightly, so nightly R2 publishes now run in thereleaseenvironment — flagging in case the environment has protection rules that would stall nightlies).publish-releasenow fails when the GitHub Release already exists as public instead of silently no-opping.A latent bug this work also fixed: the check-runs poll used
gh api -f(implicit POST → 404 on a GET-only endpoint). The same bug existed in the sharedrelease-plz-crates.ymlgate and is fixed on.githubmain viawrightkit/.github#131.ci: harden release publication gates and timeouts