Repository navigation
fix(helm): verify hand-made tags before every release attach, not just create - #96
Closed
tim-thacker-nullify wants to merge 1 commit into
Closed
tim-thacker-nullify wants to merge 1 commit into
tim-thacker-nullify wants to merge 1 commit into
Conversation
…t create The tag step only checked a pre-existing tag's tree (and never its ancestry on main) in the branch that creates a fresh release; a release hand-made in the GitHub UI with a missing asset skipped verification entirely and got main's package uploaded to it. git ls-remote --exit-code also treated any non-zero exit as "no tag", so an unreachable remote fell through to gh release create --target, which GitHub ignores once a tag exists. - Determine tag existence once via git ls-remote, failing loudly on any exit code other than 0 (tag exists) or 2 (no tag). - Whenever the tag exists, require both its commit is an ancestor of main and its tree matches $target before any upload or create, whether or not a release already exists. - Scope the tree comparison to helm-charts/<name> plus only the manifest files that chart's own README references, instead of the whole manifests/ directory, so one chart's manifest change can no longer fail another chart's tag check. - publish-helm-repo.sh: have verify_tag_chart_version return a distinct exit status for "not on main" so the three callers stop collapsing it into "or its tree is not <name> <version>". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
tim-thacker-nullify
added a commit
that referenced
this pull request
Sep 15, 2026
fix(helm): verify hand-made tags before every release attach, not just create Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round-6 review of #95 found the tag step's hand-made-tag guard only ran on the branch that creates a fresh release.
git ls-remote --exit-codetreated any non-zero exit as "no tag", so an unreachable remote fell through togh release create --target, which GitHub ignores once a tag exists (R6-95-3).manifests/directory, so one chart's manifest change could fail another chart's tag check (R6-95-4).Fix, all in the tag step:
git ls-remoteexit other than 0 or 2.helm-charts/<name>plus only the manifest paths that chart's own README references) before any upload or create.publish-helm-repo.sh:verify_tag_chart_versionnow returns a distinct exit status for "not on main" so its three callers stop collapsing that into "or its tree is not<name><version>".Operational rule: never hand-create
<chart>-v*tags or GitHub releases, including in the UI — release jobs create them.The publish stack (#60 ← #65 ← #70 ← #75 ← #84 ← #95 ← this PR) collapses after a quick diff check.
🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.