Block release if checks are failing - #6029
Conversation
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| per_page: 100, | ||
| }, | ||
| ); | ||
| const failingChecks = checkRuns.filter((check) => | ||
| failingConclusions.has(check.conclusion), | ||
| ); |
There was a problem hiding this comment.
When a production tag is pushed while a check run or commit status is still pending, the validation only filters for completed failures and succeeds, causing image and release jobs to begin before all checks have completed successfully.
Knowledge Base Used: Secure Image Builds: apko, melange, and securebuild
| steps: | ||
| - name: Fail if the tagged commit has failing checks | ||
| if: github.ref_type == 'tag' && !contains(needs.generate-tag.outputs.tag, '-') | ||
| uses: actions/github-script@v9 |
There was a problem hiding this comment.
The new release-time step references actions/github-script through the mutable v9 tag while inheriting contents: write; pinning the action to a commit and narrowing this job to read-only permissions reduces the impact of an upstream action compromise.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
What this PR does / why we need it:
If a commit is tagged for a production release and it has failing checks, the workflow will fail before producing a release and pushing images.
Which issue(s) this PR fixes:
NONE
Does this PR require a test?
Does this PR require a release note?
New features:
Bug fixes:
Improvements:
Does this PR require documentation?