promote-release.yml's "every pipeline it dispatches to is present" check validates nothing since ci-shared.yml switched to absolute uses:

[matt-edmondson]

What's wrong

The Resolve and validate step in .github/workflows/promote-release.yml (around lines 64–91 on current main) loads ci-shared.yml and checks that every pipeline it dispatches to exists at the commit being promoted. The check only examines jobs whose uses: starts with ./:

if not uses.startswith("./"):
    continue

Commit a343f55 ("Reference the pipelines absolutely, not relatively") changed both dispatch jobs in ci-shared.yml to absolute references:

uses: ktsu-dev/.github/.github/workflows/dotnet.yml@release          # line 152
uses: ktsu-dev/.github/.github/workflows/dotnet-private.yml@release  # line 161

Every job is now skipped. missing is always empty, and the step always prints "ci-shared.yml and every pipeline it dispatches to are present."

Failure scenario

A commit on main renames or deletes dotnet.yml or dotnet-private.yml. Promotion still succeeds and the release tag moves. Every repository's ci.yml then fails with "workflow was not found", which is the org-wide outage this check exists to prevent (see the comment above the step).

Verification

Parsing ci-shared.yml with PyYAML, the same way the step does, gives startswith('./') == False for both dotnet-public and dotnet-private. No job is checked.

Suggested fix

1. Also resolve uses values of the form ktsu-dev/.github/<path>@<ref>: strip the repo prefix and @ref, then run git cat-file -e "$SHA:<path>".
2. Fail on any uses that points at another repository, or at a ref other than release, that the check can't resolve.
3. Fail when zero pipelines were checked, so the check can't silently pass again.

Acceptance criteria

• Deleting dotnet.yml on a branch makes the promote dry run fail and name the missing pipeline.
• The step reports how many pipelines it verified.

[matt-edmondson]

Triage

• Category: Bug
• Priority: High. This safety check exists to prevent an org-wide CI outage, and since a343f55 it checks nothing. A rename or delete of dotnet.yml or dotnet-private.yml would promote cleanly, and then every repository's ci.yml would fail with "workflow was not found". There is no active failure today; the risk is latent.
• Area / suggested assignee: the "Resolve and validate" step in .github/workflows/promote-release.yml. Owner: @matt-edmondson
• Duplicates / in progress: none found. The ~39 open "Move CI onto the shared ci-shared.yml pipeline" PRs across the org increase reliance on ci-shared.yml, which makes this check more important, but none of them fixes it.
• Next step: resolve ktsu-dev/.github/<path>@release references as well as ./ references. Fail on any unresolvable external uses, and fail when zero pipelines were verified. Confirm with a dry run that deletes dotnet.yml.

---

Generated by Claude Code