From 4b85113262b2fbe5fe011a6cf66b98e2141b0bf6 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Thu, 24 Sep 2026 18:31:24 -0700 Subject: [PATCH] Publish: accept tags on release/* branches for hotfix releases The publish workflow only built a tag whose commit is on main. That keeps every image tied to reviewed code, but it means production can only get a fix together with everything that has landed on main since its release. A tag on a release/* branch is now accepted too. A hotfix branch starts at an earlier release tag, takes fixes through pull requests into it (so the code is still reviewed and CI-tested before it is tagged), bumps brand_version! and is tagged there. The tag must still equal v, and the step prints which branch it was found on. A tag runs the workflow file from its own commit, so a hotfix branch that starts before this change needs this commit cherry-picked onto it before its tag is pushed. --- .gitea/workflows/publish.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml index 5c50ffb..74cb77b 100644 --- a/.gitea/workflows/publish.yml +++ b/.gitea/workflows/publish.yml @@ -31,8 +31,11 @@ # crates/types/src/branding.rs, not Cargo.toml, and the image is tagged # with it, so a tag beside an unbumped macro would publish an image that # reports a different version from its tag. -# * the tag must be on main, so an image never describes code that was never -# reviewed onto the default branch. +# * the tag must be on main or on a release/* branch, so an image never +# describes code that was never reviewed onto one of them. A release/* +# branch carries a hotfix: it starts at an earlier release tag, takes +# fixes through pull requests into it, and is tagged there, so production +# can get a fix without everything that has landed on main since. # # :latest moves with every published tag: tags are cut by the weekly release # (or by hand for a real release); there are no prerelease tags here. @@ -74,8 +77,13 @@ jobs: echo "Refusing to publish an image that would report the wrong version." >&2 exit 1 fi - git merge-base --is-ancestor "$(git rev-parse "${TAG}^{commit}")" origin/main \ - || { echo "$TAG is not on main" >&2; exit 1; } + commit="$(git rev-parse "${TAG}^{commit}")" + on="" + for ref in origin/main $(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/*'); do + if git merge-base --is-ancestor "$commit" "$ref"; then on="$ref"; break; fi + done + [ -n "$on" ] || { echo "$TAG is not on main or a release/* branch" >&2; exit 1; } + echo "$TAG is on $on" echo "version=$V" >> "$GITHUB_OUTPUT" echo "version $V" -- 2.54.0