Skip to content

Guard release publish against non-default-ref dispatch mis-versioning - #185

Merged
ptr727 merged 1 commit into
mainfrom
develop
Jun 23, 2026
Merged

Guard release publish against non-default-ref dispatch mis-versioning#185
ptr727 merged 1 commit into
mainfrom
develop

Conversation

@ptr727

Copy link
Copy Markdown
Owner

Promote the downstream-re-sync fixes from develop to main.

  • publish-release.yml: fail fast when a publish is dispatched on a non-default ref; a schedule/dispatch builds both branches in the matrix regardless of the triggering ref, so a non-default dispatch mis-versions the main leg and publishes a malformed non-prerelease "Latest".
  • build-release-task.yml: refuse to create a main release whose SemVer2 carries any prerelease identifier (root-cause-agnostic safety net).
  • .editorconfig: correct JSON/JSONC casing in the section comment.
  • build-pypilibrary-task.yml: note the transient post-promotion exception in the PEP 440 ordering comment.

Fixes#183
Fixes#182
Fixes#181

…#184)
Surfaced while re-syncing the PlexCleaner downstream onto the template.
- `publish-release.yml`: fail fast when a publish is dispatched on a
non-default ref; the matrix builds both branches, so a non-default
dispatch mis-versions the main leg and publishes a malformed
non-prerelease "Latest".
- `build-release-task.yml`: refuse to create a main release whose
`SemVer2` carries a prerelease suffix (root-cause-agnostic safety net).
- `.editorconfig`: correct JSON/JSONC casing in the section comment.
- `build-pypilibrary-task.yml`: note the transient post-promotion
exception in the PEP 440 ordering comment.
Fixes#183Fixes#182Fixes#181
CopilotAI review requested due to automatic review settings June 23, 2026 00:06

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds guardrails to prevent malformed public releases when publish-release.yml is manually dispatched from a non-default ref, and adds a defense-in-depth check to ensure main releases never publish a prerelease-form SemVer2. It also includes small comment/casing fixes discovered during downstream re-syncs.

Changes:

  • Add a fail-fast check in publish-release.yml to reject workflow_dispatch runs launched from a non-default ref (the publish matrix always builds both branches).
  • Add a safety-net step in build-release-task.yml to refuse publishing a main GitHub release if SemVer2 contains a prerelease suffix (-...).
  • Fix minor comment/casing issues (.editorconfig JSON/JSONC casing; clarify PEP 440 ordering comment in PyPI build task).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

FileDescription
.github/workflows/publish-release.ymlFails fast on manual dispatch from a non-default ref to prevent mis-versioned main leg releases.
.github/workflows/build-release-task.ymlAdds a main-only SemVer2 sanity check to prevent publishing malformed non-prerelease “Latest” releases.
.github/workflows/build-pypilibrary-task.ymlClarifies the PEP 440 ordering comment to note the transient post-promotion exception.
.editorconfigUpdates the JSON/JSONC section comment casing to match documented tooling-name casing.

@ptr727
ptr727 merged commit 023f96f into mainJun 23, 2026
14 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants

@ptr727