97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
name: Expedited Release Audit
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Release tag to audit
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
# Pinned to an immutable commit: this job holds an issues-write token.
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Fetch dev
|
|
run: git fetch origin dev
|
|
|
|
- name: Audit release path
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ACTOR: ${{ github.actor }}
|
|
TRIGGER_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Release App triggers on v*, but only semver tags are releases.
|
|
# Stray tags (e.g. vffe6fee-dev) must not open audit issues.
|
|
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "$TAG is not a semver release tag; skipping" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
if git merge-base --is-ancestor "$(git rev-list -n1 "$TAG")" origin/dev; then
|
|
echo "PR-first release; tag commit is on dev; no action" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
existing_issue="$(gh issue list \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--label emergency-change \
|
|
--state all \
|
|
--search "in:title \"Post-hoc review: $TAG\"" \
|
|
--limit 1 \
|
|
--json url \
|
|
--jq '.[0].url // ""')"
|
|
if [[ -n "$existing_issue" ]]; then
|
|
echo "Post-hoc review issue already exists: $existing_issue" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
gh label create emergency-change \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--color D93F0B \
|
|
--description "Expedited change requiring post-hoc review (SOC 2 evidence)" || true
|
|
|
|
release_runs_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/workflows/release-macos-aarch64.yml?query=branch%3A$TAG"
|
|
tag_commit="$(git rev-list -n1 "$TAG")"
|
|
|
|
body_file="$RUNNER_TEMP/post-hoc-review.md"
|
|
cat > "$body_file" <<EOF
|
|
This tag points at a commit that was not on \`dev\` when it was released
|
|
(tag-first expedited path — versions live in tags, so no bump commit exists).
|
|
|
|
- [ ] Reason / incident link:
|
|
- [ ] Release App run: $release_runs_url
|
|
- [ ] Triggering audit run: $TRIGGER_RUN_URL
|
|
- [ ] Tagged commit ($tag_commit) landed on \`dev\` through a reviewed PR
|
|
- [ ] Reviewed by someone other than the release actor
|
|
|
|
Release actor: @$ACTOR
|
|
|
|
Only the reviewer closes this issue, per [the emergency-change policy]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/blob/dev/docs/EMERGENCY-CHANGES.md).
|
|
EOF
|
|
|
|
issue_url="$(gh issue create \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--title "Post-hoc review: $TAG (tag-first release)" \
|
|
--label emergency-change \
|
|
--body-file "$body_file")"
|
|
gh issue edit "$issue_url" --add-assignee "$ACTOR" || true
|
|
echo "Post-hoc review issue: $issue_url" >> "$GITHUB_STEP_SUMMARY"
|