From 58b07ef36cc815c2309ba43874ca5365f928ff77 Mon Sep 17 00:00:00 2001 From: Richard Courtman Date: Sat, 29 Aug 2026 01:29:17 +0100 Subject: [PATCH] Serialize Docker staging after draft recovery --- .github/workflows/create-release.yml | 3 ++- .../internal/subsystems/deployment-installability.md | 10 ++++++++++ scripts/installtests/build_release_assets_test.go | 6 ++++-- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index de11a22b93..cd0a27d170 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -1217,7 +1217,8 @@ jobs: needs: - prepare - build_release_candidate - if: ${{ always() && needs.prepare.result == 'success' && needs.build_release_candidate.result == 'success' && needs.prepare.outputs.historical_asset_backfill_only != 'true' && github.event.inputs.draft_only != 'true' }} + - create_release + if: ${{ always() && needs.prepare.result == 'success' && needs.build_release_candidate.result == 'success' && needs.create_release.result == 'success' && needs.prepare.outputs.historical_asset_backfill_only != 'true' && github.event.inputs.draft_only != 'true' }} permissions: contents: read packages: write diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index cda0eb47d2..0460c81b06 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -1985,6 +1985,16 @@ non-oversubscribed `1/1/1` API allocation plus one non-API package worker. The existing 10-GiB admission floor still degrades the shard count on constrained hosts instead of weakening the watchdog. +Recovery run `33223074961` retargeted the unpublished draft and annotated tag +to corrected source SHA `148b9a0e329c488d1a4401060008543988c81113`, but its two +exact-version Docker publication legs validated release-line policy before the +independent draft-resume job had moved the tag. Both failed closed on the old +tag target without publishing or activating customer pointers. Exact-version +Docker staging may continue to overlap container qualification, backend tests, +and the other independent release gates, but it must depend on successful +draft creation or recovery so release-line validation always observes the +current immutable tag target. + The preceding `v6.4.0-rc.8` qualification attempt used exact source SHA `bac7e5d9526d76a6b4e34738511b07609dda80ed`. Release run `33128595650` passed preparation, frontend bundle, Windows installer smoke, release smoke, diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 48dca0c14e..40d53c0dac 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -2597,13 +2597,15 @@ func TestReleasePipelinePromotesOneImmutableCandidate(t *testing.T) { publishDockerJob := workflowJobBlock(t, createWorkflow, "publish_docker") for _, needle := range []string{ "- build_release_candidate", + "- create_release", + "needs.create_release.result == 'success'", `source_sha: ${{ github.sha }}`, } { if !strings.Contains(publishDockerJob, needle) { - t.Fatalf("inert exact-version Docker staging missing acceleration contract: %s", needle) + t.Fatalf("inert exact-version Docker staging missing recovery-safe dependency contract: %s", needle) } } - for _, forbiddenDependency := range []string{"- qualify_release_containers", "- create_release"} { + for _, forbiddenDependency := range []string{"- qualify_release_containers"} { if strings.Contains(publishDockerJob, forbiddenDependency) { t.Fatalf("inert exact-version Docker staging must overlap independent qualification: %s", forbiddenDependency) }