fix(ci): validate the dispatch tag in release.yml - #71
Merged
Conversation
Gap I introduced in #63, caught in review of the same port to hotdata-ibis (hotdata-dev/hotdata-ibis#44). publish.yml got a pre-checkout guard on the dispatch input; release.yml did not, despite needing it more. release.yml holds contents: write, and action-gh-release CREATES a tag when tag_name does not resolve to one. So an unvalidated `tag: main` checks out cleanly and then leaves refs/tags/main plus a release named for it, both needing manual cleanup. publish.yml at worst wastes a run. The push path is constrained by the v[0-9]* tag filter; the dispatch path had no constraint at all. Same guard and same strict form as publish.yml, so the input contract matches in both. sdk-python already had this -- its dispatch predates this work.
anoop-narang
requested review from
shefeek-jinnah
and removed request for
a team
August 11, 2026 17:19
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
My description claimed parity between the two workflows and it was not true. In this repo publish.yml never gained a pre-checkout step -- #63 only switched its existing "Verify tag matches pyproject version" check to $TAG, which runs AFTER checkout and is looser (^v[0-9]). So `-f tag=v1.2` or `v1.2.3rc1` was accepted there and rejected in release.yml. Tightening publish.yml rather than loosening release.yml, since release.sh only ever produces X.Y.Z -- it enforces ^[0-9]+\.[0-9]+\.[0-9]+$ on explicit versions, so the strict form is the correct contract. Both workflows now validate the same input the same way, before fetching an arbitrary ref. The post-checkout version match stays: it catches a tag that is well-formed but does not match pyproject.
There was a problem hiding this comment.
Prior nit resolved: publish.yml now carries the same strict pre-checkout guard, so both dispatch contracts accept exactly vX.Y.Z and validate before any ref is fetched. Verified the premise in scripts/release.sh:143 — explicit versions are gated on ^[0-9]+\.[0-9]+\.[0-9]+$, so the strict form matches what the release script can actually produce. Keeping the looser post-checkout version match is correct; it is still the only format check on the push path and covers the different failure of a well-formed tag that disagrees with pyproject.toml.
Note CI was still queued/in progress when this review ran, so I am not asserting anything about check results.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gap I introduced in #63, caught in review of the same port to hotdata-ibis
(hotdata-dev/hotdata-ibis#44). publish.yml got a pre-checkout guard on the
dispatch input; release.yml did not, despite needing it more.
release.yml holds contents: write, and action-gh-release CREATES a tag when
tag_name does not resolve to one. So an unvalidated
tag: mainchecks outcleanly and then leaves refs/tags/main plus a release named for it, both needing
manual cleanup. publish.yml at worst wastes a run. The push path is constrained
by the v[0-9]* tag filter; the dispatch path had no constraint at all.
Same guard and same strict form as publish.yml, so the input contract matches in
both. sdk-python already had this -- its dispatch predates this work.
How this was found
Reviewing the same port into
hotdata-ibis(hotdata-dev/hotdata-ibis#44), where a reviewer pointed out the asymmetry. Checking back here showed I'd introduced it in#63—publish.ymlgot the guard,release.ymldidn't.sdk-pythonwas unaffected: itsworkflow_dispatchpredates this work and already shipped with validation, which is where I took the form from.Risk being closed
Low likelihood — needs write access plus a deliberate typo — but the cleanup is manual and the fix is three lines.