From 417beb16db872d11d244ffb420b7477325019447 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Sat, 18 Jul 2026 09:10:27 -0400 Subject: [PATCH] fix(ci): install actionlint in the Release Test job so the emitted-workflow guard runs The Release workflow's Test job runs go test ./... over internal/generate, whose emitted-workflow enforcement guard hard-fails under CI when the actionlint binary is absent. That job did not install actionlint, so a real release would fail its Test job and publish nothing. Add the same SHA-pinned actionlint install used by validate.yaml and pr.yaml, ordered after setup-go and before the test step. Signed-off-by: Joshua Temple --- .github/workflows/release.yaml | 7 +++++++ CHANGELOG.md | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ab43aeff..e500f77b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -66,6 +66,13 @@ jobs: with: go-version-file: go.mod + # actionlint must be on PATH so the emitted-workflow enforcement guard + # (TestActionlint_FeatureMatrix and the census-driven sweep) genuinely runs + # instead of skipping. Pinned to the same SHA the workflow-lint job uses so + # the guard and the repo's own workflow lint agree on the actionlint version. + - name: Install actionlint + run: go install github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 + - name: Run tests run: go test -v ./... diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d7161d3..c8b7d983 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,14 @@ A `Migration` section is added to any release that bumps `schema_version`. ### Fixed +- **ci:** The Release workflow's `Test` job now installs the SHA-pinned + `actionlint` binary before `go test ./...`, matching the unit-test lanes in + `validate.yaml` and `pr.yaml`. The emitted-workflow enforcement guard + hard-fails under CI when `actionlint` is absent, so a release-time test run + without it would fail its `Test` job and publish nothing. The install is + pinned to the same version the `workflow-lint` job uses, so there is no + version drift. + - **promote:** A matrix-based promote deploy (a deploy declaring inputs) now threads the per-promotion environment and sha to its reusable-workflow callback, matching orchestrate. The matrix path previously emitted only the