Allow-list the release candidate's RC and GA tags for runner groups

Release binaries are built from tags, not branches: pushing v2.14.0-rc1
runs the build workflows at refs/tags/v2.14.0-rc1. GitHub matches
selected_workflows entries on the exact ref, so the @refs/heads/release/2.14
entries this script already emits do not authorize those runs, and the tag
had to be added to the groups by hand for 2.14.0-rc1.

Emit the candidate version's tag refs alongside the branch refs. Only the
GA tag and the newest v<version>-rc<n> are pinned; each RC supersedes the
last, and pinning every one would grow both the allow-list and the per-ref
discovery cost by a workflow set per tag (2.13 reached rc15). A newer RC
evicting an older one is fine - the allow-list is checked when a job starts,
so in-flight builds are unaffected.

Tags come from git/matching-refs, which returns the refs under the prefix in
one request rather than paging pytorch/pytorch's entire tag history. The
prefix is not anchored (v2.1 also matches v2.1.0), so names are still
filtered against the exact tag pattern.

Author: huydhn

tools/scripts/release_manage_runner_groups.py

@@ -7,10 +7,12 @@
 
 - ensure ``pytorch/pytorch`` is an allowed repository (add-only), and
 - restrict allowed workflows to the release workflows discovered in
-  ``pytorch/pytorch``, pinned to ``main``, ``nightly`` and the release branches
+  ``pytorch/pytorch``, pinned to ``main``, ``nightly``, the release branches
   around the test-channel version (the ``release/X.Y`` anchor read from
   ``generate_binary_build_matrix.py`` plus the preceding protected release
-  branch).
+  branch), and the candidate's release tags (the GA ``v<version>`` tag and the
+  newest ``v<version>-rc<n>``, which is where the release binaries are actually
+  built from).
 
 Release workflows are discovered, not hardcoded, by the release runner label
 they run on (the ``rel-`` marker, e.g. ``rel-l-x86iavx512-44-340``). An entry
@@ -111,15 +113,19 @@ def paginate(
 # --- Desired state: target refs -------------------------------------------
 
 
-def get_test_version_anchor() -> Tuple[int, int]:
+def get_candidate_version() -> str:
     # The release runner groups serve the release-candidate builds, so anchor on
     # CURRENT_CANDIDATE_VERSION from generate_binary_build_matrix (the version
     # used for release builds, advanced deliberately at go-live) rather than
     # inferring it from a branch-name scan (which drifts: a release/X.Y branch is
     # cut weeks before it is the actual candidate).
     import generate_binary_build_matrix as gbm
 
-    major, minor = gbm.CURRENT_CANDIDATE_VERSION.split(".")[:2]
+    return str(gbm.CURRENT_CANDIDATE_VERSION)
+
+
+def get_test_version_anchor() -> Tuple[int, int]:
+    major, minor = get_candidate_version().split(".")[:2]
     return int(major), int(minor)
 
 
@@ -145,13 +151,71 @@ def select_target_refs(
     return [f"refs/heads/{name}" for name in selected]
 
 
+def release_tag_re(version: str) -> "re.Pattern[str]":
+    """Matches the GA and release-candidate tags for ``version``.
+
+    pytorch/pytorch tags releases as ``v<version>`` with candidates numbered
+    ``v<version>-rc<n>``, e.g. ``v2.14.0`` and ``v2.14.0-rc1``.
+    """
+    return re.compile(rf"^v{re.escape(version)}(?:-rc(\d+))?$")
+
+
+def select_target_tags(tag_names: Iterable[str], version: str) -> List[str]:
+    """The GA tag and the newest release-candidate tag for ``version``.
+
+    Release binaries are built from tags, not branches: pushing ``v2.14.0-rc1``
+    runs the build workflows at ``refs/tags/v2.14.0-rc1``. GitHub matches
+    ``selected_workflows`` entries on the exact ref, so a
+    ``@refs/heads/release/2.14`` entry does not authorize that run and the tag
+    has to be pinned in its own right.
+
+    Only the newest RC is kept: each tag supersedes the last, and pinning every
+    one would grow both the allow-list and the per-ref discovery cost by a
+    workflow set per tag (2.13 reached rc15).
+    """
+    pattern = release_tag_re(version)
+    ga: List[str] = []
+    candidates: List[Tuple[int, str]] = []
+    for name in tag_names:
+        match = pattern.match(name)
+        if match is None:
+            continue
+        number = match.group(1)
+        if number is None:
+            ga.append(name)
+        else:
+            candidates.append((int(number), name))
+    selected = sorted(ga)
+    if candidates:
+        selected.append(max(candidates)[1])
+    return [f"refs/tags/{name}" for name in selected]
+
+
+def get_release_tags(client: GitHubClient, version: str) -> List[str]:
+    # matching-refs returns every ref under the prefix in a single request;
+    # listing /tags would page through pytorch/pytorch's entire tag history. The
+    # prefix is not anchored (a ``v2.1`` prefix also matches ``v2.1.0``), so the
+    # names are still filtered against the exact tag pattern.
+    refs = client.request(
+        "GET", f"/repos/{TARGET_REPO}/git/matching-refs/tags/v{version}"
+    ).json()
+    names = [str(ref["ref"]).removeprefix("refs/tags/") for ref in refs]
+    return select_target_tags(names, version)
+
+
 def get_target_refs(client: GitHubClient) -> List[str]:
+    version = get_candidate_version()
     anchor = get_test_version_anchor()
     log(f"Test-channel version anchor: release/{anchor[0]}.{anchor[1]}")
     branches = client.paginate(
         f"/repos/{TARGET_REPO}/branches", params={"protected": "true"}
     )
-    return select_target_refs((branch["name"] for branch in branches), anchor)
+    refs = select_target_refs((branch["name"] for branch in branches), anchor)
+    tags = get_release_tags(client, version)
+    if not tags:
+        # Expected between the candidate bump and the first RC tag.
+        log(f"No release tags cut yet for v{version}")
+    return refs + tags
 
 
 # --- Desired state: workflow discovery -------------------------------------
@@ -301,7 +365,7 @@ def discover_release_workflows(
     """
     paths_by_ref: Dict[str, Set[str]] = {}
     for ref in refs:
-        rev = ref.removeprefix("refs/heads/")
+        rev = ref.removeprefix("refs/heads/").removeprefix("refs/tags/")
         paths = collect_release_workflow_paths(fetch_workflow_files(client, rev))
         log(f"Discovered {len(paths)} release workflow(s) on {TARGET_REPO}@{rev}:")
         for path in sorted(paths):

tools/tests/test_release_manage_runner_groups.py

@@ -81,6 +81,44 @@ def test_sorts_release_numerically_not_lexically(self) -> None:
         )
 
 
+class TestSelectTargetTags(TestCase):
+    def test_ga_and_newest_candidate(self) -> None:
+        names = ["v2.14.0-rc1", "v2.14.0-rc2", "v2.14.0"]
+        self.assertEqual(
+            m.select_target_tags(names, "2.14.0"),
+            ["refs/tags/v2.14.0", "refs/tags/v2.14.0-rc2"],
+        )
+
+    def test_candidate_only_before_ga(self) -> None:
+        self.assertEqual(
+            m.select_target_tags(["v2.14.0-rc1"], "2.14.0"),
+            ["refs/tags/v2.14.0-rc1"],
+        )
+
+    def test_sorts_candidates_numerically_not_lexically(self) -> None:
+        # rc9 must rank below rc10 despite string ordering.
+        names = ["v2.13.0-rc9", "v2.13.0-rc10"]
+        self.assertEqual(
+            m.select_target_tags(names, "2.13.0"),
+            ["refs/tags/v2.13.0-rc10"],
+        )
+
+    def test_ignores_other_versions(self) -> None:
+        # matching-refs is a prefix query, so v2.1 also returns v2.1x tags.
+        names = ["v2.1.0", "v2.1.0-rc1", "v2.14.0-rc1"]
+        self.assertEqual(
+            m.select_target_tags(names, "2.1.0"),
+            ["refs/tags/v2.1.0", "refs/tags/v2.1.0-rc1"],
+        )
+
+    def test_ignores_unconventional_suffixes(self) -> None:
+        names = ["v2.14.0-rc1-test", "v2.14.0rc1", "2.14.0-rc1", "v2.14.0-rc"]
+        self.assertEqual(m.select_target_tags(names, "2.14.0"), [])
+
+    def test_no_tags_yet(self) -> None:
+        self.assertEqual(m.select_target_tags([], "2.14.0"), [])
+
+
 class TestUsesReleaseLabel(TestCase):
     def test_matches_release_labels(self) -> None:
         self.assertTrue(m.uses_release_label("runs-on: rel-l-x86iavx512-44-340"))