Skip to content

fix(ci): verify-index must read the authoritative index, not the raw CDN #497

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LukasWodka merged 2 commits into from
Jul 30, 2026
Merged

fix(ci): verify-index must read the authoritative index, not the raw CDN #497

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c60167a
fix(ci): read index.yaml via the contents API, not the raw CDN
LukasWodka Jul 30, 2026
0b1bf13
fix(ci): emit the empty-read error on stdout so it annotates
LukasWodka Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion .github/workflows/release-helm-chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,11 +449,31 @@ jobs:
env:
TAG: ${{ github.event.release.tag_name }}
PRERELEASE: ${{ needs.verify.outputs.prerelease }}
permissions:
contents: read # read index.yaml from gh-pages via the API
steps:
- name: Assert the public index holds only stable versions
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euo pipefail
idx=$(curl -fsSL --retry 3 "https://raw.githubusercontent.com/$GITHUB_REPOSITORY/gh-pages/index.yaml?nocache=$GITHUB_RUN_ID")

# Read the blob through the CONTENTS API, not raw.githubusercontent.com.
# raw.* is CDN-fronted and serves a stale copy for a while after a
# gh-pages push; `?nocache=` does not reliably bust it (Bugbot on
# client#495). This job runs seconds after `release` may have pushed,
# so a stale read could show a clean index while the customer-facing
# one is already polluted -- greening the exact backstop this job
# exists to be. The API is read-after-write consistent for a ref.
idx=$(gh api "repos/$GITHUB_REPOSITORY/contents/index.yaml?ref=gh-pages" \
-H "Accept: application/vnd.github.raw+json")
if [ -z "$idx" ]; then
# stdout, not stderr: Actions parses workflow commands from stdout
# only, so an ::error:: on stderr fails the step with no annotation
# (Bugbot, client#497). Every sibling ::error:: here uses stdout.
echo "::error::could not read index.yaml from gh-pages - refusing to report the invariants as holding on an empty read."
exit 1
fi
# No prerelease-shaped chart version may ever be indexed.
if printf '%s\n' "$idx" | grep -E '^[[:space:]]+version:' | grep -- '-'; then
echo "::error::public helm index contains prerelease-shaped versions (above) - customer surface polluted."
Expand Down
Loading