fix(ci): release gates fail closed on cancelled jobs + refuse malformed version input - #1719
Merged
Conversation
…ed version input Three fixes from the v0.10.7 release incident (2026-08-18): 1. build (and smoke/soak) required 'not failed' instead of explicit success. failure() does not cover a needed job that TIMED OUT (conclusion 'cancelled'), so lint hitting its 15-min timeout cascaded test into 'skipped' and the pipeline published with the whole test matrix and asan-soak silently skipped. build now requires lint success plus either test success or the sanctioned skip_tests input; smoke/soak require build success explicitly. 2. The tag is inputs.version verbatim: dispatching a bare '0.10.7' published a release the installers can never resolve (they fetch releases/download/v<version>/...), and under immutable releases the mis-named tag cannot be retagged or its name reused. A preflight job now refuses any non-v-prefixed version before anything runs. 3. Lint's 15-min timeout was one slow-runner day away from cancelling a normally-5-min job; raised to 30 so only a genuine hang can hit it. Release-path only (workflow_dispatch); adds one ~5s preflight job; no PR-CI gating, cost, or trigger changes. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The contract required the bare '!cancelled() && !failure()' idiom on build/smoke/soak — the exact form the v0.10.7 incident proved fail-open (failure() does not cover a CANCELLED needed job). It now requires each gate's explicit accepted results, the sanctioned skip_tests clause on build, and the preflight version guard wired before lint. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three root causes of the v0.10.7 release incident, closed at the pipeline level (details in the commit message): cancelled-job cascade published with tests skipped; bare version input burned an immutable tag name; lint timeout too tight.
Scope flags (CI-change sensitivity): release workflow_dispatch path only — no PR-CI gating changes, +one 5-second preflight job, no new flake surface (lint bound loosened 15→30m), trigger scope unchanged.
🤖 Generated with Claude Code
https://claude.ai/code/session_018RiRAw9RQhvCoshqe7eZHV