🐛 Fix goreleaser workflow conditions for tag pushes#6888
Conversation
The workflow conditions were failing on tag pushes because the `inputs` context is undefined when not triggered via workflow_dispatch. Changes: - Fix "Trigger mql bump in cnspec" to run on tag pushes by checking `github.event_name == 'push'` as a fallback - Simplify GoReleaser step conditions to use only the skip-publish step output, consolidating the logic in one place (the skip-publish step already checks the input) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
![mondoo-code-review[bot]](https://avatars.githubusercontent.com/in/2834902?s=60&v=4){kind=small}
|
|
||
| - name: Run GoReleaser and promote latest | ||
| if: ${{ inputs.skip-publish != true && steps.skip-publish.outputs.skip-publish != 'true' }} | ||
| if: ${{ steps.skip-publish.outputs.skip-publish != 'true' }} |
There was a problem hiding this comment.
🟡 warning — Removing inputs.skip-publish != true means that when the workflow is triggered via workflow_dispatch with skip-publish: true, the "promote latest" step will still run (since steps.skip-publish.outputs.skip-publish may not be 'true'). Verify that the skip-publish step reliably sets its output to 'true' whenever inputs.skip-publish is true, otherwise this change silently breaks the manual skip-publish opt-in.
|
|
||
| - name: Run GoReleaser without promoting 'latest' | ||
| if: ${{ inputs.skip-publish == true || steps.skip-publish.outputs.skip-publish == 'true' }} | ||
| if: ${{ steps.skip-publish.outputs.skip-publish == 'true' }} |
There was a problem hiding this comment.
🟡 warning — Same concern here: the "without promoting latest" step now only checks the step output. If the step output isn't guaranteed to mirror the inputs.skip-publish value, a workflow_dispatch with skip-publish: true could fall through both conditions (or hit neither). Confirm the skip-publish step propagates the input correctly.
| # The docker container is a pre-requisite for cnspec release. | ||
| - name: Trigger mql bump in cnspec | ||
| if: ${{ inputs.skip-publish != true && inputs.skip-cnspec-bump != true && inputs.make-latest != false }} | ||
| if: ${{ steps.skip-publish.outputs.skip-publish != 'true' && (github.event_name == 'push' || (inputs.skip-cnspec-bump != true && inputs.make-latest != false)) }} |
There was a problem hiding this comment.
🔵 suggestion — The new condition github.event_name == 'push' will trigger the cnspec bump on every tag push unconditionally (ignoring skip-cnspec-bump and make-latest). If a tag push should also respect those flags (e.g. for pre-release tags), consider gating it further. Otherwise, add a brief comment explaining why tag pushes always bump cnspec.
2 participants
Summary
inputscontext is undefined on push events)Test plan
🤖 Generated with Claude Code