Harden release publication transactions - #57
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d6b404655
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const failed = [...byWorkflow.values()].filter( | ||
| (run) => | ||
| run.status === "completed" && FAILURE_CONCLUSIONS.has(run.conclusion), | ||
| ); |
There was a problem hiding this comment.
When a failed push-triggered CI run is followed by a newer workflow_dispatch run for the same commit and workflow name, latestByWorkflow selects the manual run and this filter drops the failed push run, so the monitor reports the release green. I reproduced this with distinct databaseId values and push/workflow_dispatch events. gh run list --help documents --event as filtering runs by the triggering event; use that field or the requested databaseId/attempt fields to distinguish an actual rerun from a separate run.
Useful? React with 👍 / 👎.
2 participants
Summary
Verification
bun run check(619 pass, 1 intentional skip)bun run replay(13/13)actionlint .github/workflows/release.ymlRecovery contract
The exact draft is created only under the full current-main proof and remains invisible. If npm succeeds and
mainadvances before GitHub finalization, a rerun reuses that exact draft, observes exact npm integrity, rechecks that the remote tag has not moved, and publishes only after every asset digest is exact. Conflicting metadata, assets, package integrity, prerelease state, and unknown remote state fail closed.