fix(gha): use sound condition gating for latest-tag step#40035
Merged
Conversation
The `if:` on the `Run latest-tag` step used a `${{ }}` template
interpolation inside an expression context, which is the zizmor
"unsound-condition" pattern. The expression is template-substituted
*before* it is parsed, so when `steps.latest-tag.outputs.SKIP_TAG` is
empty (which happens on the "no latest tags yet" path of
`scripts/tag_latest_release.sh`, where `SKIP_TAG` is never written to
`$GITHUB_OUTPUT` before the script exits), the condition becomes the
malformed expression `(! )` and GitHub Actions evaluates it as falsy —
so the tag step is skipped on the very first release when it should
run.
Replace with a direct string comparison
`steps.latest-tag.outputs.SKIP_TAG != 'true'`, which:
- evaluates soundly in all cases (empty, "false", "true"),
- matches the script's intent (skip only when SKIP_TAG is explicitly
"true"), and
- mirrors how other workflows in this repo gate on step outputs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
rusackas
requested review from
betodealmeida,
craig-rueda,
dpgaspar,
eschutho,
geido,
hainenber,
kgabryje,
mistercrunch,
nytai,
sadpandajoe and
villebro
as code owners
Contributor
|
Bito Automatic Review Skipped - Files Excluded |
github-actions
Bot
added
the
github_actions
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
hainenber
approved these changes
May 12, 2026
Contributor
|
Unrelated but we should probably integrate |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
The
if:on theRun latest-tagstep in.github/workflows/latest-release-tag.ymlused a${{ }}template interpolation inside an expression context — the zizmorunsound-conditionpattern. The expression is template-substituted before it is parsed, so the value ofsteps.latest-tag.outputs.SKIP_TAGis spliced in literally:becomes one of:
(! true )→ expression parses tofalse→ step skipped ✓(! false )→ expression parses totrue→ step runs ✓(! )→ malformed expression whenSKIP_TAGis empty/undefined → GitHub Actions treats it as falsy → step skipped ✗That third case is reachable in practice.
scripts/tag_latest_release.shhas a "no latest tags yet" path (scripts/tag_latest_release.sh:126-131) that callsrun_git_tagand exits without ever writingSKIP_TAGto$GITHUB_OUTPUT. Under the workflow's--dry-runinvocation,run_git_tagis a no-op, so the script exits withSKIP_TAGunset. The buggy condition then evaluates(! )and skips the tag step on the very first release, exactly when it most needs to run.This PR replaces the interpolated condition with a sound direct comparison:
which:
'','false','true'),SKIP_TAGis explicitly"true"),BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — CI/workflow change only.
TESTING INSTRUCTIONS
GitHub Actions workflow conditions can't be unit-tested in the repo's test suite. The fix can be reasoned about against the GHA expression docs and validated by inspection of
scripts/tag_latest_release.shpaths:SKIP_TAGvalue(! ${{ ... }} )... != 'true'"true"(equal / older release)(! true )→false→ skip'true' != 'true'→false→ skip"false"(newer release)(! false )→true→ run'false' != 'true'→true→ run""(no-latest-tags path)(! )→ malformed → skip'' != 'true'→true→ runADDITIONAL INFORMATION
The same workflow has a separate finding at line 23:
source ./scripts/tag_latest_release.sh $(echo ${{ github.event.release.tag_name }}) --dry-run${{ github.event.release.tag_name }}is interpolated directly into a shell command — a zizmortemplate-injectionclass issue. That is a distinct fix (move the tag name to anenv:var and reference it as"$TAG_NAME") and is intentionally out of scope for this PR.