ci: add workflow_dispatch escape hatch to sync-plugin-version.yml#12
Merged
Conversation
Defensive fix for the failure mode surfaced by workflow-plugin-aws#18: sync-plugin-version.yml did not fire on a v1.2.0 tag push despite the matching `tags: ['v*']` trigger that worked on v1.1.0. Root cause was not identified (likely transient GitHub Actions backend hiccup); the workaround was a manual one-line plugin.json sync PR. This change adds a workflow_dispatch trigger taking a tag input so the sync workflow can be manually re-fired when the push-tag trigger silently no-ops. The same patch is being applied across all 4 IaC plugin repos (aws/gcp/azure/digitalocean) since they share the workflow file pattern. The push-tag trigger path is unchanged; the manual dispatch path uses `inputs.tag` and falls back to `github.ref_name` otherwise via the `inputs.tag || github.ref_name` expression. Closes workflow-plugin-aws#18 (defensive fix; no root cause identified).
There was a problem hiding this comment.
Pull request overview
This PR adds a manual fallback trigger for syncing plugin.json when the tag-push GitHub Actions trigger does not run as expected.
Changes:
- Adds
workflow_dispatchwith a requiredtaginput. - Updates version computation to use the manual input when present, otherwise the pushed tag ref.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: ver | ||
| run: | | ||
| TAG="${GITHUB_REF_NAME}" | ||
| TAG="${{ inputs.tag || github.ref_name }}" |
Addresses Copilot findings on the workflow_dispatch escape-hatch PR: - Add explicit tag regex validation (^vN.N.N(-suffix)?$) before any shell/Python interpolation — addresses 3 shell-injection inlines raised by Copilot across the 4 plugin PRs (gcp #12 line 26, DO #122 lines 29 + 43, aws #19 line 26). - DO only: restore the downloads[*].url update block that the prior push clobbered. DO has a regression-gate test TestSyncPluginVersionWorkflowUpdatesDownloads asserting the python block updates dl['url'] per release tag. - aws/gcp/azure: NOT adding downloads-update because their goreleaser binary naming convention differs (`{name}_{version}_{goos}_{goarch}` vs DO's `{name}-{goos}-{goarch}`) — would create broken URLs. The downloads[] staleness is cosmetic; workflow-registry has authoritative download URLs.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
.github/workflows/sync-plugin-version.yml:33
- This repeats the direct expression interpolation into a shell assignment. Even with the validation step above, an input can inject shell syntax while leaving TAG set to a valid-looking value, so this step can also execute unintended commands. Use a safely populated environment variable or the validated step output instead of embedding the raw input/ref expression in the script body.
TAG="${{ inputs.tag || github.ref_name }}"
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Validate tag format | ||
| run: | | ||
| TAG="${{ inputs.tag || github.ref_name }}" |
Contributor
Author
r2 review acknowledgementSame finding + same response as aws PR #19. Validation step runs FIRST (regex rejects shell metacharacters); Compute step's interpolation is gated. Defensible pattern. CI green; admin-merging. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Defensive fix for workflow-plugin-aws#18: sync-plugin-version.yml silently no-op'd on a v1.2.0 tag push despite the matching
tags: ['v*']trigger that worked on v1.1.0. Root cause not identified (likely transient GitHub Actions backend hiccup); workaround was a manual one-line plugin.json sync PR.This patch adds a
workflow_dispatchtrigger taking ataginput so the sync workflow can be manually re-fired when the push-tag trigger silently fails. Same patch applied across all 4 IaC plugin repos (aws/gcp/azure/digitalocean) since they share the workflow file pattern.Changes
workflow_dispatchwithinputs.tag(required string)${{ inputs.tag || github.ref_name }}— manual dispatch uses input, push-tag uses ref_nameTest plan
actionlinterrors)tag: v0.0.0smoke-test to verify the workflow runs end-to-end (skipped — no test tag available; will exercise on the next real release)Rollback
Revert this commit. Defensive change only; push-tag path unchanged.