fix(gha): pass -R to gh pr edit in release_github relabel step - #372
Merged
Conversation
gh pr edit was shelling out to git to auto-detect the repo, and git
refused inside the release_github container ("dubious ownership"),
breaking the autorelease-tagged relabel and blocking the next
release-please PR.
so0k
added
ci/skip-examples
jsteinich
approved these changes
Aug 7, 2026
X-Guardian
pushed a commit
to X-Guardian/cdk-terrain
that referenced
this pull request
Aug 10, 2026
…constructs#372) ## Summary - The `release_github` job's "Mark merged release PR as tagged" step calls `gh pr edit` without an explicit repo, so `gh` shells out to `git` to auto-detect it. - That job runs inside the `jsii-terraform` container, where the checkout is owned by a different UID than the container user, so `git` refuses with "detected dubious ownership" and the step fails (exit code 1), even though the GitHub release itself already succeeded. - Fix: pass `-R "${{ github.repository }}"` to `gh pr edit` so it never needs `git` to infer the repo — smallest possible fix, no container/git config changes needed. Note: an alternative fix would be adding a `git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain` step after checkout (as `prepare-release` and `prepare-next` already do), but passing `-R` avoids touching git config in the container entirely. Diagnosed from the failed run: https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482 As an immediate unblock, I've also manually relabeled the affected PR (open-constructs#303) from `autorelease: pending` to `autorelease: tagged` so release-please can open the next release PR. ## Test plan - [ ] Next release run exercises the `release_github` job's relabel step and confirms `gh pr edit -R ...` succeeds inside the container
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release_githubjob's "Mark merged release PR as tagged" step callsgh pr editwithout an explicit repo, soghshells out togitto auto-detect it.jsii-terraformcontainer, where the checkout is owned by a different UID than the container user, sogitrefuses with "detected dubious ownership" and the step fails (exit code 1), even though the GitHub release itself already succeeded.-R "${{ github.repository }}"togh pr editso it never needsgitto infer the repo — smallest possible fix, no container/git config changes needed.Note: an alternative fix would be adding a
git config --global --add safe.directory /__w/cdk-terrain/cdk-terrainstep after checkout (asprepare-releaseandprepare-nextalready do), but passing-Ravoids touching git config in the container entirely.Diagnosed from the failed run: https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482
As an immediate unblock, I've also manually relabeled the affected PR (#303) from
autorelease: pendingtoautorelease: taggedso release-please can open the next release PR.Test plan
release_githubjob's relabel step and confirmsgh pr edit -R ...succeeds inside the container