fix(ci): install actionlint in the Release Test job so the emitted-workflow guard runs - #636
Merged
Merged
Conversation
…rkflow guard runs The Release workflow's Test job runs go test ./... over internal/generate, whose emitted-workflow enforcement guard hard-fails under CI when the actionlint binary is absent. That job did not install actionlint, so a real release would fail its Test job and publish nothing. Add the same SHA-pinned actionlint install used by validate.yaml and pr.yaml, ordered after setup-go and before the test step. Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Release workflow's
Testjob (release.yaml) runsgo test -v ./...over the root module, which includesinternal/generate. That package's emitted-workflow enforcement guard (TestActionlint_FeatureMatrixplus the census-driven sweeps) hard-fails under CI (os.Getenv("CI") != "") when theactionlintbinary is not on PATH, by design so it can never silently skip.The guard's SHA-pinned
actionlintinstall was added tovalidate.yamlandpr.yamlbut not torelease.yaml. At release time thatTestjob therefore hard-fails on the guard tests, so a real Release would fail itsTestjob and publish nothing. A dry-run Release surfaced this.This is release-path-critical: it gates whether a release publishes. It is not generated output, so it is not fleet-relevant in the generator sense.
Fix
Add the identical SHA-pinned
actionlintinstall (go install github.com/rhysd/actionlint/cmd/actionlint@914e7df... # v1.7.12, same SHA asworkflow-lint, so no version drift) torelease.yaml'sTestjob, ordered aftersetup-goand before the test step.Lane audit (every CI job running
go testoverinternal/generate)go testvalidate.yamlTest (go test ... ./...)pr.yamlunit tests (go list ./... | grep -v /e2e | xargs go test)release.yamlTest (go test -v ./...)validate.yaml./harness/...e2e.yamle2e/go.mod)go testThe fix keeps the guard's deliberate hard-fail-under-CI behavior (anti-silent-skip from #631); it corrects the CI wiring so actionlint is present rather than weakening the guard.
Verification
go build ./...,go test ./...(actionlint on PATH),golangci-lint run ./...all greenactionlintclean on the edited workflows (workflow-lintstays green)cascade verify --own-repo: 3 files, no drift (these workflows are hand-authored)[Unreleased]entry added; changelog guard passes post-commit