ci: publish GitHub release as a draft until post-release steps succeed - #3348
Draft
javirln wants to merge 2 commits into
Draft
Conversation
GoReleaser now creates the release as a draft. The workflow runs all post-release steps (SBOM upload, Grype scans, source-code attestation, version bumps, attestation push, release-note edits) against the draft and adds a final success()-gated step that flips the draft to published. A failure in any post-release step leaves the release as a draft rather than publishing a public but incomplete release. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
The source-code attestation step ran before the release is published (it is now created as a draft) and relied on `gh release download -A tar.gz`, which depends on GitHub's auto-generated source asset that is only exposed once a release is published. Fetch the archive directly by git tag instead so the step succeeds against a draft; otherwise it would fail, keep success() false, and leave every release stuck as a draft. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
Member
Author
|
Good catch — fixed in 69eb523. The |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The release workflow used to publish the GitHub release immediately via GoReleaser and then keep adding post-release artifacts (SBOMs, vulnerability reports, Chainloop attestation link, source-code attestation, release-note edits). When one of those post-release steps failed, the release was already public but incomplete.
This makes the release atomic from a user's perspective:
.goreleaser.yml: therelease:block now setsdraft: true, so GoReleaser creates the release as a draft..github/workflows/release.yaml: all existing post-release steps run against the draft (they reference it by tag). A finalsuccess()-gated Publish release step flips the draft to published only after every post-release step has succeeded.If any post-release step fails, the release stays a draft for a human to inspect or retry, rather than a broken release going public.
Refs PFM-6883.
Assisted-by: Claude Code