From c6de686cb40720ccb5f0a291fb1dc03aa82dfdb9 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sat, 4 Apr 2026 15:13:16 +0100 Subject: [PATCH] Fix release workflow branch policy env --- .github/workflows/create-release.yml | 1 + .../v6/internal/subsystems/deployment-installability.md | 7 +++++++ scripts/release_control/release_promotion_policy_test.py | 1 + 3 files changed, 9 insertions(+) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index b02e71b11..66f2e1936 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -131,6 +131,7 @@ jobs: env: VERSION: ${{ steps.extract.outputs.version }} TAG: ${{ steps.extract.outputs.tag }} + REQUIRED_BRANCH: ${{ steps.branch_policy.outputs.required_branch }} IS_PRERELEASE: ${{ steps.extract.outputs.is_prerelease }} PROMOTED_FROM_TAG_INPUT: ${{ github.event.inputs.promoted_from_tag }} ROLLBACK_VERSION_INPUT: ${{ github.event.inputs.rollback_version }} diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 1fabdc009..b43d67998 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -167,6 +167,13 @@ rather than as release-candidate promises. Those same workflows must also fetch and dispatch the governed release branch derived from release-control metadata instead of hardcoding `pulse/v6`, `pulse/v6-release`, or any later branch literal inline. +That same branch-policy contract must survive step boundaries inside the +workflows themselves: `.github/workflows/create-release.yml` and +`.github/workflows/release-dry-run.yml` must pass the resolved +`steps.branch_policy.outputs.required_branch` value into the promotion-policy +validation step environment before that step fetches refs or invokes +`resolve_release_promotion.py`, rather than assuming a shell-local +`REQUIRED_BRANCH` variable still exists from an earlier step. That same `internal/updates/` boundary now also owns runtime data-dir authority for temp, backup, and cleanup behavior: `manager.go` must resolve its working directories through the shared runtime data-dir helper instead of diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py index 9c9834a4f..4ab24dcf7 100644 --- a/scripts/release_control/release_promotion_policy_test.py +++ b/scripts/release_control/release_promotion_policy_test.py @@ -164,6 +164,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase): resolver = read("scripts/release_control/resolve_release_promotion.py") self.assertIn("control_plane.py --branch-for-version", content) self.assertIn('git fetch --prune origin main "${REQUIRED_BRANCH}" --tags', content) + self.assertIn('REQUIRED_BRANCH: ${{ steps.branch_policy.outputs.required_branch }}', content) self.assertIn("resolve_release_promotion.py", content) self.assertIn("Rollback command:", content) self.assertIn("rollback target and exact reinstall command recorded", policy)