ci(refactor-release): correlate publisher runs by release identifier

[DariuszPorowski]

Summary

This is PR 10 in GitHub stack #12738 and depends on #12770; see the GoReleaser release lifecycle implementation plan.

• add stable release identifiers to Deployment Engine and Bicep publisher payloads
• query before dispatch and match the exact publisher display_title, reusing successful or active work and retrying failed work under the same identifier
• remove time-window correlation, add bounded transient API retry and uncertain-dispatch reconciliation, and cover the protocol with hermetic Node tests

Companion dependency: azure-octo/radius-publisher#25 adds identifier-based run-name and concurrency groups and must merge before this PR.

Reason for change

Time-window run discovery can select the wrong publisher run when releases overlap. Exact release identifiers make each source run monitor only its own remote work and let reruns reconcile completed or in-progress publication before dispatching again.

How to test

• make test-monitor-remote-workflow (19 tests)
• actionlint and yamllint on the three modified workflows
• ghalint run on the three modified workflows
• prettier --check on the controller and test
• zizmor --pedantic --min-severity medium on the three modified workflows

A live paired-dispatch exercise requires publisher PR #25 to be deployed first.

File change summary

File	Summary of change
.github/scripts/monitor-remote-workflow.mjs	Reconcile exact identifier-named publisher runs with bounded retry and one total deadline.
.github/scripts/monitor-remote-workflow_test.mjs	Cover dispatch, reuse, failure recovery, concurrent identifiers, transient API failures, timeout behavior, and caller wiring.
.github/workflows/__build-bicep-types.yaml	Dispatch Bicep publication with a version-and-source-SHA identifier.
.github/workflows/publish-de-image.yaml	Correlate the legacy Deployment Engine bridge with a rerun-stable tag-and-run identifier.
.github/workflows/release.yaml	Dispatch release Deployment Engine publication with a version-and-source-SHA identifier.
build/test.mk	Register the focused Node test target in the unit-test aggregate.
eng/design-notes/tools/2026-09-goreleaser-stack-review/pr-10-release-identifier-correlation.md	Review note for this layer: what changed in review, why, the value, and the impact

[Copilot]

Pull request overview

This PR improves how Radius CI dispatches and monitors publishing workflows in the external azure-octo/radius-publisher repo by correlating runs via a stable release identifier (rather than a time window), enabling safe reuse of already-successful or currently-running publisher jobs and more reliable retries.

Changes:

• Reworked .github/scripts/monitor-remote-workflow.mjs to (a) dispatch with a release_identifier embedded in the payload, (b) find runs by exact display_title, and (c) add bounded retry/backoff and a single end-to-end deadline.
• Updated the release + publisher-dispatching workflows to pass EVENT_TYPE, RELEASE_IDENTIFIER, and JSON-escaped CLIENT_PAYLOAD into the monitor script (and increased job timeouts accordingly).
• Added hermetic Node.js tests for the dispatch/monitor protocol and wired them into make test.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
build/test.mk	Adds a Node.js unit test target and includes it in the test aggregate.
.github/workflows/release.yaml	Switches DE publishing to the correlated dispatch/monitor script using a stable identifier.
.github/workflows/publish-de-image.yaml	Switches the legacy DE image publishing bridge to the correlated dispatch/monitor script.
.github/workflows/__build-bicep-types.yaml	Switches Bicep types publishing to the correlated dispatch/monitor script and adds release metadata outputs.
.github/scripts/monitor-remote-workflow.mjs	Implements identifier-based correlation, retry/backoff, bounded history scan, and uncertain-dispatch reconciliation.
.github/scripts/monitor-remote-workflow_test.mjs	Adds Node.js tests for correlation behavior, retries, timeouts, and workflow caller wiring.

Suppressed comments (1)

.github/scripts/monitor-remote-workflow.mjs:89

• If '+' is accepted in release identifiers (SemVer build metadata), the validation error message should mention it so failures are actionable.

    if (!RELEASE_IDENTIFIER_PATTERN.test(releaseIdentifier)) {
      throw new Error(
        "Release identifier must contain 1-200 letters, numbers, dots, underscores, or hyphens",
      );
    }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/release.yaml

[github-actions]

Unit Tests

    2 files  +    2    459 suites  +459   8m 54s ⏱️ + 8m 54s
6 583 tests +6 583  6 581 ✅ +6 581  2 💤 +2  0 ❌ ±0 
7 884 runs  +7 884  7 882 ✅ +7 882  2 💤 +2  0 ❌ ±0 

Results for commit 5e7b876. ± Comparison against base commit 821d4ff.

♻️ This comment has been updated with latest results.

[github-actions]

Functional Tests - upgrade-noncloud

1 tests   0 ✅  5m 5s ⏱️
1 suites  0 💤
1 files    1 ❌

For more details on these failures, see this check.

Results for commit 5e7b876.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.80%. Comparing base (821d4ff) to head (5e7b876).

Additional details and impacted files

@@                        Coverage Diff                        @@
##           dp/idempotent-tag-reconciliation   #12783   +/-   ##
=================================================================
  Coverage                             59.80%   59.80%           
=================================================================
  Files                                   777      777           
  Lines                                 45906    45906           
=================================================================
  Hits                                  27452    27452           
  Misses                                18454    18454           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Functional Tests - daprrp-noncloud

26 tests  ±0   26 ✅ ±0   14m 8s ⏱️ +55s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 60ce522. ± Comparison against base commit dcc9805.

♻️ This comment has been updated with latest results.

[github-actions]

Functional Tests - kubernetes-noncloud

23 tests   23 ✅  8m 32s ⏱️
 1 suites   0 💤
 1 files     0 ❌

Results for commit 0541440.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

Filtered workflow-run queries cannot discover identifiers beyond GitHub’s 1,000-result cap, allowing duplicate publication.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	5e7b876
Unique ID	funcdba85bc30f
Image tag	pr-funcdba85bc30f

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funcdba85bc30f
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funcdba85bc30f
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funcdba85bc30f
• controller test image location: ghcr.io/radius-project/dev/controller:pr-funcdba85bc30f
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funcdba85bc30f
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded