fix(ci): key release on validation run id, drop src-tree-hash gate

The release gate compared the merged main src tree against the validated
tree and aborted on any mismatch. But the bump commit the release creates
on main changes version.py, so the merged tree never equals the validated
(pre-bump) tree, making the gate impossible to satisfy on a retry. The
binary is built with the version injected at build time, so the tree
difference never mattered.

Remove src_tree_hash entirely. The validation records only its result and
run id on the release PR; the release gate requires a passing validation
exists and resolves the validated artifact by that run id. Nightly
validation skips only when the last recorded run already passed.

Author: vagabondHustler

.github/workflows/release.yml

@@ -34,7 +34,6 @@ jobs:
       msi_name: ${{ steps.run.outputs.msi_name }}
       artifact_id: ${{ steps.run.outputs.artifact_id }}
       validation_run_id: ${{ steps.gate.outputs.validation_run_id }}
-      src_tree_hash: ${{ steps.gate.outputs.src_tree_hash }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -80,7 +79,7 @@ jobs:
       - name: Download the validated binaries
         uses: actions/download-artifact@v4
         with:
-          name: validated_${{ needs.init.outputs.src_tree_hash }}
+          name: validated_${{ needs.init.outputs.validation_run_id }}
           path: artifacts
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ needs.init.outputs.validation_run_id }}

.github/workflows/scripts/actions.py

@@ -686,7 +686,6 @@ def make_msi(self) -> None:
 
 
 class ReleaseValidation:
-    SOURCE_TREE = "src/subsearch"
     MARKER = "release-validation"
     RESULT_PASSED = "passed"
     RESULT_FAILED = "failed"
@@ -696,10 +695,8 @@ class ReleaseValidation:
     BODY_BLOCK_START = "<!-- release-validation:start -->"
     BODY_BLOCK_END = "<!-- release-validation:end -->"
 
-    # Matches the marker HTML comment: <!-- release-validation:result=passed;src=<hash>;run=<id> -->
-    _STATE_PATTERN = re.compile(
-        r"<!--\s*release-validation:result=(?P<result>\w+);src=(?P<src>[0-9a-f]+);run=(?P<run>\d+)\s*-->"
-    )
+    # Matches the marker HTML comment: <!-- release-validation:result=passed;run=<id> -->
+    _STATE_PATTERN = re.compile(r"<!--\s*release-validation:result=(?P<result>\w+);run=(?P<run>\d+)\s*-->")
 
     def open_release_pr(self) -> str | None:
         completed = subprocess.run(
@@ -727,25 +724,7 @@ def open_release_pr(self) -> str | None:
         number = completed.stdout.strip()
         return number or None
 
-    def src_tree_hash(self, commit: str = "HEAD") -> str:
-        completed = subprocess.run(
-            ["git", "rev-parse", f"{commit}:{self.SOURCE_TREE}"],
-            check=True,
-            capture_output=True,
-            text=True,
-        )
-        return completed.stdout.strip()
-
-    def pr_head_sha(self, number: str) -> str:
-        completed = subprocess.run(
-            ["gh", "pr", "view", number, "--json", "headRefOid", "--jq", ".headRefOid"],
-            check=True,
-            capture_output=True,
-            text=True,
-        )
-        return completed.stdout.strip()
-
-    def last_validation(self, number: str) -> tuple[str, str, str] | None:
+    def last_validation(self, number: str) -> tuple[str, str] | None:
         completed = subprocess.run(
             ["gh", "pr", "view", number, "--json", "comments", "--jq", ".comments[].body"],
             check=True,
@@ -759,23 +738,21 @@ def last_validation(self, number: str) -> tuple[str, str, str] | None:
                 match = found
         if match is None:
             return None
-        return match.group("src"), match.group("result"), match.group("run")
+        return match.group("result"), match.group("run")
 
     def should_validate(self, number: str) -> bool:
         previous = self.last_validation(number)
         if previous is None:
             return True
-        validated_src, result, _ = previous
-        if result != self.RESULT_PASSED:
-            return True
-        return validated_src != self.src_tree_hash(self.pr_head_sha(number))
+        result, _ = previous
+        return result != self.RESULT_PASSED
 
-    def _marker_body(self, src_tree_hash: str, result: str, run_id: str) -> str:
-        comment = f"<!-- {self.MARKER}:result={result};src={src_tree_hash};run={run_id} -->"
+    def _marker_body(self, result: str, run_id: str) -> str:
+        comment = f"<!-- {self.MARKER}:result={result};run={run_id} -->"
         passed = result == self.RESULT_PASSED
         validation_outcome = "passed" if passed else "failed"
         status = f"Release validation {validation_outcome}"
-        return f"{comment}\n**{status}** — src tree `{src_tree_hash}` (run {run_id})"
+        return f"{comment}\n**{status}** (run {run_id})"
 
     def _has_marker_comment(self, number: str) -> bool:
         completed = subprocess.run(
@@ -787,9 +764,9 @@ def _has_marker_comment(self, number: str) -> bool:
         comments = json.loads(completed.stdout)["comments"]
         return any(f"<!-- {self.MARKER}:" in comment["body"] for comment in comments)
 
-    def _body_block(self, src_tree_hash: str, result: str, run_id: str) -> str:
+    def _body_block(self, result: str, run_id: str) -> str:
         outcome = "passed" if result == self.RESULT_PASSED else "failed"
-        line = f"###### Release validation {outcome} — src tree `{src_tree_hash}` (run {run_id})"
+        line = f"###### Release validation {outcome} (run {run_id})"
         return "\n".join([self.BODY_BLOCK_START, line, self.BODY_BLOCK_END])
 
     def _replace_body_block(self, body: str, block: str) -> str:
@@ -801,22 +778,22 @@ def _replace_body_block(self, body: str, block: str) -> str:
             return f"{block}\n\n{body}"
         return body[:start] + block + body[end + len(self.BODY_BLOCK_END) :]
 
-    def _update_body(self, number: str, src_tree_hash: str, result: str, run_id: str) -> None:
+    def _update_body(self, number: str, result: str, run_id: str) -> None:
         completed = subprocess.run(
             ["gh", "pr", "view", number, "--json", "body", "--jq", ".body"],
             check=True,
             capture_output=True,
             text=True,
         )
         existing_body = completed.stdout.rstrip("\n")
-        block = self._body_block(src_tree_hash, result, run_id)
+        block = self._body_block(result, run_id)
         new_body = self._replace_body_block(existing_body, block)
         subprocess.run(["gh", "pr", "edit", number, "--body", new_body], check=True)
 
-    def record_validation(self, number: str, src_tree_hash: str, result: str, run_id: str) -> None:
-        body = self._marker_body(src_tree_hash, result, run_id)
+    def record_validation(self, number: str, result: str, run_id: str) -> None:
+        body = self._marker_body(result, run_id)
         command = ["gh", "pr", "comment", number, "--body", body]
         if self._has_marker_comment(number):
             command.append("--edit-last")
         subprocess.run(command, check=True)
-        self._update_body(number, src_tree_hash, result, run_id)
+        self._update_body(number, result, run_id)

.github/workflows/scripts/jobs.py

@@ -356,7 +356,6 @@ def run(self) -> None:
 
         step_summary.set_output("proceed", "true" if proceed else "false")
         step_summary.set_output("pr_number", number)
-        step_summary.set_output("src_tree_hash", validation.src_tree_hash(validation.pr_head_sha(number)))
 
 
 class ValidateRecord:
@@ -366,15 +365,14 @@ class ValidateRecord:
     def run(self) -> None:
         validation = ReleaseValidation()
         number = os.environ["PR_NUMBER"]
-        src_tree_hash = os.environ["SRC_TREE_HASH"]
         run_id = os.environ["GITHUB_RUN_ID"]
 
         required_passed = all(os.environ.get(name) == "success" for name in self._REQUIRED_RESULTS)
         # Binary tests are optional (skip_binary_tests dispatch input); a skipped run is acceptable, a failed one is not.
         tests_passed = os.environ.get("TEST_RESULT") in self._ACCEPTABLE
         passed = required_passed and tests_passed
         result = validation.RESULT_PASSED if passed else validation.RESULT_FAILED
-        validation.record_validation(number, src_tree_hash, result, run_id)
+        validation.record_validation(number, result, run_id)
 
 
 class ReleaseGate:
@@ -383,16 +381,15 @@ def run(self) -> None:
         step_summary = StepSummary()
 
         number = os.environ["PR_NUMBER"]
-        merge_src_tree_hash = validation.src_tree_hash("HEAD")
         previous = validation.last_validation(number)
 
-        if previous is None or previous[1] != validation.RESULT_PASSED or previous[0] != merge_src_tree_hash:
-            step_summary.card(f"No validated artifact matching src tree {merge_src_tree_hash}", passed=False)
-            raise SystemExit(f"No validated artifact matching src tree {merge_src_tree_hash}")
+        if previous is None or previous[0] != validation.RESULT_PASSED:
+            step_summary.card("No passing validation found for the release pull request", passed=False)
+            raise SystemExit("No passing validation found for the release pull request")
 
-        step_summary.set_output("src_tree_hash", merge_src_tree_hash)
-        step_summary.set_output("validation_run_id", previous[2])
-        step_summary.card(f"Validated artifact found for src tree {merge_src_tree_hash}", passed=True)
+        _, validation_run_id = previous
+        step_summary.set_output("validation_run_id", validation_run_id)
+        step_summary.card(f"Validated artifact found (run {validation_run_id})", passed=True)
 
 
 class ReadValidatedHashes:

.github/workflows/validate-release.yml

@@ -37,7 +37,6 @@ jobs:
     outputs:
       proceed: ${{ steps.run.outputs.proceed }}
       pr_number: ${{ steps.run.outputs.pr_number }}
-      src_tree_hash: ${{ steps.run.outputs.src_tree_hash }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -106,7 +105,7 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: validated_${{ needs.gate.outputs.src_tree_hash }}
+          name: validated_${{ github.run_id }}
           path: artifacts
           if-no-files-found: error
           retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
@@ -126,7 +125,7 @@ jobs:
 
       - uses: actions/download-artifact@v4
         with:
-          name: validated_${{ needs.gate.outputs.src_tree_hash }}
+          name: validated_${{ github.run_id }}
           path: artifacts
 
       - uses: ./.github/actions/install-test-deps
@@ -186,7 +185,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ needs.gate.outputs.pr_number }}
-          SRC_TREE_HASH: ${{ needs.gate.outputs.src_tree_hash }}
           INIT_RESULT: ${{ needs.init.result }}
           BUILD_RESULT: ${{ needs.build_binaries.result }}
           TEST_RESULT: ${{ needs.test_binaries.result }}