Skip to content

fix(release-finalize): guard the tag target on a release-PR merge - #24

Merged
jjavieralv merged 1 commit into
mainfrom
fix/finalize-tag-tested-head
Oct 28, 2026
Merged

jjavieralv merged 1 commit into
mainfrom
fix/finalize-tag-tested-head

Conversation

@tyhonchik

@tyhonchik tyhonchik commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

On a release-PR merge the tag goes on the PR head or on the merge commit, and which one follows what the base branch is. A base branch that keeps moving while the release PR is open (aragon/app: feature merges into main) gets the PR head, the commit the checks ran on; the merge commit would also carry what landed in the meantime, built and tested by nobody under that version. A base branch that is a release line and receives nothing but release and hotfix merges (aragon/app-backend: main, back-merged into development, hotfixes ported into open releases) gets the merge commit, which is the base branch itself.

Three aragon/app flows tagged the merge commit of a moving main: the assistant 0.3.1 finalize failed its changesets guard on two changesets merged after the branch was cut (run).

Changes

  • Guard in release-finalize.yml: on a pull_request event the run fails before tagging when sha is neither the PR head nor the merge commit, or when it is not reachable from the base branch (a squashed release PR). Non-PR callers (hotfix flows) are untouched.
  • Docs and examples say which target fits which base branch: header of the workflow, README, release-design.md, both examples.

No interface change (sha stays required). The app flows switch to the head in aragon/app#1533; the backend keeps the merge commit; aragon-indexer already passes the head.

🤖 Generated with Claude Code

On a release-PR merge the tag goes on the PR head (the commit the checks ran
on, for a base branch that keeps moving while the PR is open) or on the merge
commit (for a base branch that is a release line, as the backend's main). Three
aragon/app flows tagged the merge commit of a moving main: the assistant 0.3.1
finalize failed its changesets guard on two changesets merged after the branch
was cut. A guard now fails the run when 'sha' is neither, or when it is not
reachable from the base branch (a squashed release PR). Docs and examples say
which target fits which base branch.
@tyhonchik
tyhonchik force-pushed the fix/finalize-tag-tested-head branch from 2f00a0e to a04d987 Compare October 28, 2026 11:32
@tyhonchik tyhonchik changed the title fix(release-finalize): refuse to tag anything but the tested PR head fix(release-finalize): guard the tag target on a release-PR merge Oct 28, 2026
@jjavieralv
jjavieralv merged commit e8a50a6 into main Oct 28, 2026
4 checks passed
@jjavieralv
jjavieralv deleted the fix/finalize-tag-tested-head branch October 28, 2026 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants