Skip duplicate GitHub release and pin tag to built commit SHA - #408
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves the robustness of the scheduled/manual release publishing workflow by (1) avoiding duplicate GitHub releases for unchanged weekly runs and (2) pinning the GitHub release tag to an immutable commit SHA produced by Nerdbank.GitVersioning (NBGV), rather than the moving main ref.
Changes:
- Add a pre-check that detects whether a GitHub release for the computed
SemVer2tag already exists and conditionally skips release creation. - Pin
softprops/action-gh-release’starget_commitishto the NBGVGitCommitIdoutput to avoid tagging a newer commit than the one versioned. - Expose
GitCommitIdas an output from the reusableget-version-task.ymlworkflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/publish-release.yml | Adds “release exists” gating and switches tag pinning from main to GitCommitId for the GitHub release job. |
| .github/workflows/get-version-task.yml | Exposes NBGV GitCommitId via workflow outputs so downstream jobs can pin to the versioned commit. |
This was referenced Jun 4, 2026
ptr727
added a commit
that referenced
this pull request
Jun 4, 2026
Follow-up to #408 (Copilot review on #411): the "Check for existing release" step always logged "skipping release creation", but on `workflow_dispatch` the create step is allowed through (to repair a release), so the log was misleading. Make the message event-aware — it now says the dispatch will refresh the release instead of skipping. Log-string only; no behavior change. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
ptr727
added a commit
that referenced
this pull request
Jun 4, 2026
Release merge of `develop` into `main`. ## Changes - **Release-job robustness** (#408, closes #407): skip GitHub release creation on no-op weekly runs (when the `SemVer2` tag already exists), while still allowing `workflow_dispatch` to repair a release; and pin `target_commitish` + the release-job checkout to NBGV `GitCommitId` (the exact built commit) instead of the moving `main` ref. Ported from ptr727/ProjectTemplate#98. - Dependabot: bump `dorny/paths-filter` 3 → 4 (#409). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
ptr727
added a commit
that referenced
this pull request
Jun 4, 2026
) Back-port from the PlexCleaner two-phase CI/CD port (ptr727/PlexCleaner#723), where this repo's patterns were audited for the same issues. ## Applied - **Gate `smoke-build` on `test-release`** (`needs: [changes, test-release]`). The smoke build builds Docker images, so it shouldn't be spent when the test job is already failing; a failed `test-release` now leaves smoke-build skipped and the aggregator blocks on the test failure directly. Brings NxWitness in line with the sibling repos' PR workflows. ## Audited — already present in NxWitness (no change needed) - `github-release` checks out NBGV `GitCommitId` and allows `workflow_dispatch` through the skip-if-exists gate (#408/#412). - Docker `cache-to` already uses `ignore-error=true` (gha cache). - `publish-release.yml` has **no `push` trigger**, so the no-op-push concurrency/badge issues don't arise. - `publish-docker-readme-task` is called with an explicit `ref: main`, so it renders the README from the right branch. ## Noted for maintainer follow-up (NOT changed here) - **`build-main` feeds the versioned release from a moving `ref: main`** while `get-version` resolves the release version separately — the same race fixed in PlexCleaner/ProjectTemplate by pinning leaf builds to `GitCommitId`. That pin is **not safe to apply here**: `build-docker-task` overloads `inputs.ref` as the image-matrix branch selector (`select(.Branch == $ref)`), so passing a SHA would match no rows. A proper fix decouples `ref` (checkout/version) from `branch` (matrix selector) — a small refactor better owned by the maintainer. (Low practical risk: requires a commit landing on `main` mid-publish.) All workflows pass `actionlint`. Handed to the maintainer for merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #407.
Two robustness fixes to the
github-releasejob inpublish-release.yml, ported from ptr727/ProjectTemplate#98.1. Skip duplicate release on no-op weeks
The weekly schedule re-runs even when
mainhas no new commits, so NBGV produces the sameSemVer2andsoftprops/action-gh-releaseis asked to (re)create an existing release/tag — churning the release every week and risking failures re-uploading existing assets. Added aCheck for existing releasestep (gh release view "$SemVer2") that gates the release-creation step, so a no-op week is a true no-op.2. Pin release tag to the built commit, not a moving ref
target_commitish: mainis a moving ref — a commit landing onmainmid-run could tag the release on a newer commit than the one built. Pinned it to NBGV'sGitCommitId(the exact commit the version was computed from;get-versionruns withref: main). AddedGitCommitIdas aget-version-task.ymloutput.Matches the existing file conventions (no new action pins introduced).
🤖 Generated with Claude Code