ci: turn the orphaned deploy job into a release-artifacts check - #463
Merged
Merged
Conversation
The deploy job dates from #123, long before #319 moved releasing to the bazel-contrib release ruleset. Since then it has published nothing: no workflow downloads its JAR or release.tar.gz, and release_prep.sh builds the real ones at tag time. Make it honest about being a per-PR build check instead. - Rename to release-artifacts, with a comment on what owns publishing. - Drop id-token/attestations write permissions. Nothing here attests. - Pack the archive with pack_release_archive.sh, the same script release_prep.sh and bcr_consumer.yaml use, so the checked archive is the shipped recipe. The `make release_source_archive` it called had drifted -- no __pycache__/*.pyc excludes -- so this job was checking an archive releases never produce. That Makefile target now delegates to the script rather than repeating the tar. - Give the job an explicit name so its status check is stable. Derived names are why branch protection still requires `deploy (11)`, which stopped existing when the job gained an os matrix; adding a matrix key should not rename a required check. Branch protection still needs updating by hand: `deploy (11)` no longer exists and the new checks are `release-artifacts (<os>)`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
deployjob inci.yamldates from #123, long before #319 moved releasing to the bazel-contrib release ruleset. Since then it has published nothing — no workflow downloads itsbazel-diff_deploy.jarorrelease.tar.gz(zerodownload-artifactreferences in.github/), andrelease_prep.shbuilds the real ones at tag time. This makes the job honest about being a per-PR build check.deploy→release-artifacts, with a comment on what actually owns publishing.id-token: write/attestations: write. Nothing in the job attests; leftovers from when it really was the deploy.pack_release_archive.sh— the same scriptrelease_prep.shandbcr_consumer.yamluse — instead ofmake release_source_archive. The Makefile copy had drifted (no__pycache__/*.pycexcludes), so the job was verifying an archive releases never produce.make release_source_archivenow delegates to the script, leaving one tar recipe.name:so its status check is stable.The multi-platform Rust matrix added in #462 stays as-is: it is what surfaced the Windows
MAX_PATHfailure thatrelease.yamlwould otherwise have hit at tag time.mastercurrently requires the status checkdeploy (11), which stopped existing the moment #462 gave that job an os matrix — GitHub derives implicit job names from every matrix value. That is why this PR adds an explicit name: adding a matrix key should never rename a required check.After merge, replace
deploy (11)with:release-artifacts (ubuntu-latest)release-artifacts (macos-latest)release-artifacts (windows-latest)Test plan
release-artifacts (ubuntu-latest)uploadsbazel-diff_deploy.jar+release.tar.gz//release:bazel-diff-rustand upload their assetpack_release_archive.shexcludes__pycache__/*.pyc(verified locally: 3,900 entries, no.github)make release_source_archiveworks via the delegated script (verified locally)🤖 Generated with Claude Code