Skip to content

fix: make release workflow resilient to re-runs [skip changelog] #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avifenesh merged 4 commits into from
Feb 27, 2026
Merged

fix: make release workflow resilient to re-runs [skip changelog] #577

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
482b09d
fix: make release workflow resilient to re-runs
avifenesh Feb 27, 2026
0e3e5f1
ci: trigger new workflow run for skip-changelog
avifenesh Feb 27, 2026
2a6e9bd
fix: address review feedback on release workflow
avifenesh Feb 27, 2026
a7d05ef
fix: address second round of review feedback
avifenesh Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 49 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,35 +246,63 @@ jobs:
SCRIPT
chmod +x /tmp/wait-for-crate.sh

- name: Create idempotent publish helper
run: |
set -euo pipefail
cat > /tmp/publish-crate.sh << 'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
if [ $# -ne 2 ]; then
echo "Usage: $0 <crate> <version>" >&2
exit 1
fi
crate="$1"
version="$2"
echo "Publishing $crate $version..."
if cargo publish -p "$crate" 2>&1; then
echo "$crate $version published successfully"
else
# Check crates.io API for the specific version (handles older tags, indexing lag)

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment on line 265 mentions "handles older tags, indexing lag", but this check is specifically for detecting if a crate version is already published. The comment is misleading because the check happens during a publish failure, not as a general check for existence.

Consider clarifying: "Check if crate version already exists on crates.io (handles re-runs after partial failures)"

Suggested change
# Check crates.io API for the specific version (handles older tags, indexing lag)
# Check if crate version already exists on crates.io (handles re-runs after partial failures)

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Updated the comment to clarify it handles re-runs after partial failures.

status=$(curl -s -o /dev/null -w "%{http_code}" "https://crates.io/api/v1/crates/$crate/$version")
if [ "$status" = "200" ]; then
echo "$crate $version already published, skipping"
else
echo "Publish failed and $crate $version not found on crates.io (HTTP $status)"
exit 1
fi
fi
SCRIPT
chmod +x /tmp/publish-crate.sh

# Publish order: agnix-rules (leaf) -> agnix-core -> agnix-cli/agnix-lsp/agnix-mcp
- name: Publish agnix-rules
run: cargo publish -p agnix-rules
run: /tmp/publish-crate.sh agnix-rules ${{ steps.version.outputs.version }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Wait for agnix-rules indexing
run: /tmp/wait-for-crate.sh agnix-rules ${{ steps.version.outputs.version }}

- name: Publish agnix-core
run: cargo publish -p agnix-core
run: /tmp/publish-crate.sh agnix-core ${{ steps.version.outputs.version }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Wait for agnix-core indexing
run: /tmp/wait-for-crate.sh agnix-core ${{ steps.version.outputs.version }}

- name: Publish agnix-cli
run: cargo publish -p agnix-cli
run: /tmp/publish-crate.sh agnix-cli ${{ steps.version.outputs.version }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Publish agnix-lsp
run: cargo publish -p agnix-lsp
run: /tmp/publish-crate.sh agnix-lsp ${{ steps.version.outputs.version }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Publish agnix-mcp
run: cargo publish -p agnix-mcp
run: /tmp/publish-crate.sh agnix-mcp ${{ steps.version.outputs.version }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

Expand Down Expand Up @@ -444,6 +472,8 @@ jobs:
run: npm --prefix website run version:cut -- "${{ steps.version.outputs.version }}"

- name: Commit and push versioned docs
env:
GH_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
Expand All @@ -452,6 +482,19 @@ jobs:
if git diff --cached --quiet; then
echo "No changes to commit"
else
BRANCH="docs/version-${{ steps.version.outputs.version }}"
git checkout -B "$BRANCH"
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using git push --force-with-lease on line 488 is safer than regular force-push, but in this context where the branch is created fresh on line 486 with git checkout -B, the force-with-lease provides limited protection. If this is a re-run and the branch already exists remotely, force-with-lease will prevent overwriting if someone else pushed to it in the meantime.

This is correct behavior for the use case, but consider adding a comment explaining that force-push is intentional for re-runs.

Suggested change
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"
# Intentionally force-push to update the auto-generated docs branch on workflow re-runs.

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a comment explaining force-push is intentional for re-runs of the auto-generated docs branch.

git push origin main
git push --force-with-lease origin "$BRANCH"
# Create PR only if one doesn't already exist for this branch
if gh pr view --head "$BRANCH" --json number --jq '.number' 2>/dev/null; then
echo "PR already exists for $BRANCH, updated with force push"
else
gh pr create \
--base main \
--head "$BRANCH" \
--title "docs: version ${{ steps.version.outputs.version }} docs" \
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR body on line 497 could be more informative by mentioning that it includes rule docs regeneration and site data updates (as evidenced by the files added on line 481). This would help reviewers understand the full scope of changes.

Consider: "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}, including updated rule docs and site data."

Suggested change
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}, including updated rule docs and site data." \

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to mention rule docs and site data updates.

--label "documentation"
fi

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR existence check on line 490 suppresses all errors with 2>/dev/null, which means network failures or API errors will be treated the same as "PR doesn't exist" and will attempt to create a duplicate PR. While gh pr create will likely fail in those cases, it's more robust to check the exit code and stderr explicitly.

Consider: if gh pr view --head "$BRANCH" --json number --jq '.number' >/dev/null 2>&1; then
Or add error handling to distinguish between "not found" and other errors.

Suggested change
if gh pr view --head "$BRANCH" --json number --jq '.number' 2>/dev/null; then
echo "PR already exists for $BRANCH, updated with force push"
else
gh pr create \
--base main \
--head "$BRANCH" \
--title "docs: version ${{ steps.version.outputs.version }} docs" \
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \
--label "documentation"
fi
PR_CHECK_ERR="$(mktemp)"
if gh pr view --head "$BRANCH" --json number --jq '.number' >/dev/null 2>"$PR_CHECK_ERR"; then
echo "PR already exists for $BRANCH, updated with force push"
else
if grep -qiE 'not[[:space:]]+found|could not find pull request|no pull requests' "$PR_CHECK_ERR"; then
gh pr create \
--base main \
--head "$BRANCH" \
--title "docs: version ${{ steps.version.outputs.version }} docs" \
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \
--label "documentation"
else
echo "Error checking for existing PR for $BRANCH:"
cat "$PR_CHECK_ERR"
rm -f "$PR_CHECK_ERR"
exit 1
fi
fi
rm -f "$PR_CHECK_ERR"

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Now uses a temp file for stderr and distinguishes 'not found' from API errors before attempting PR creation.

fi
Loading