basis-build: never replace an existing basis-<sha10> release - #2
Merged
Merged
Conversation
Ports the guard from BasisResearch/tlaplus#1: a re-run of the workflow on a commit that already has a release rebuilt the binaries and replaced the assets. The builds are not byte-reproducible, so that breaks any hash verus-tools-mcp has pinned. Skip publishing when the release exists; an intentional replacement needs a manual `gh release delete`. Also only cancel superseded PR runs (a cancelled mainline run left that commit without a release), and scope `contents: write` to the publish job. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ncurrency The existing-release guard treated any release under the tag as final. `gh release create` uploads assets to a draft and publishes it last, so a run killed mid-upload left a draft that every re-run then skipped, green, with nothing published. Now: - a draft is deleted and recreated (nobody can have pinned a draft); - a published release missing any of the five assets fails the job and asks for a manual delete; - a complete published release is kept, with a ::notice:: so a repair dispatch visibly did nothing. Non-PR runs now use a per-commit concurrency group. A group holds only one pending run, so a shared mainline group still dropped the middle run of three quick pushes even with cancel-in-progress off. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the release guard from BasisResearch/tlaplus#1.
The publish step deleted and recreated the
basis-<sha10>release on every run. A re-run (aworkflow_dispatch, or re-running a failed job) rebuilds the binaries, which are not byte-reproducible, so the assets under an existing tag get replaced by ones with a different sha256, breaking any hash verus-tools-mcp has pinned to that tag. The publish step now exits early when the release exists; replacing one on purpose needs a manualgh release deletefirst.Two smaller fixes from the same review:
cancel-in-progressnow applies to pull request runs only, so a quick second push to the mainline cannot cancel a run before it publishes and leave that commit without a release.contents: writeis scoped to the publish job; the build job is read-only.The download/upload paths are untouched. Unlike the tlaplus fork, this workflow builds two artifacts, so
download-artifactkeeps the per-artifact directories the glob expects.🤖 Generated with Claude Code
Review rounds (iterate-pr) added: the first guard could wedge.
gh release createuploads assets to a draft and publishes it last, so an interrupted run leaves a draft,gh release viewfinds it, and every re-run then exited 0 without publishing. The step now deletes a leftover draft and rebuilds it, keeps a published release that has all its assets (printing a::notice::), and fails with::error::if a published release is missing assets, which needs a manual delete to rebuild. Non-PR runs also get a concurrency group per commit SHA, since a shared group holds only one pending run and would drop the middle of three quick pushes.