Repository navigation
Release binary jobs no longer race each other or publish stray artifacts - #128
Merged
Merged
Conversation
The SBOM step attached its file to the GitHub release whenever the release already existed. Now that the Native AOT migrate binaries build quickly, their publish job creates the release first, and the slower read-only Windows LSP build failed replacing the asset. The publish jobs already attach every SBOM, so the build step no longer uploads to the release or as a separate workflow artifact. Each publish job downloaded every artifact in the release run, putting Deslop reports and the other binary family into its release assets and checksums. Downloads are now scoped to the workflow's own binary_name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Fix the release race that failed the
v0.11.0-betaWindows LSP build, and stop release jobs publishing artifacts that belong to other jobs.What Was Changed or Deleted?
release-binary-multiplatform.ymlandrelease-dotnet-aot-multiplatform.yml,anchore/sbom-actionattached its SBOM to the GitHub release whenever that release already existed. Now that the Native AOTDataProviderMigratebuilds succeed, their publish job creates the release early. The slower Windowslql-lspbuild then tried to replace an existing release asset with a read-only token:Resource not accessible by integration(run 38395147991).upload-release-assets: falseandupload-artifact: falseon the SBOM step. Each archive's.cdx.jsonis already in the job's own artifact and attached by its publish job.actions/download-artifactwith no filter, so they downloaded every artifact in the release run. Deslop reports, the SBOM action'sDataProvider-build.cyclonedx.jsonand the other binary family's archives ended up in the release assets and in eachSHA256SUMS.pattern: ${{ inputs.binary_name }}-*.How Do The Automated Tests Prove It Works?
v0.11.0-beta.1: everyrelease-binariesandrelease-dotnet-binariesjob must succeed, and each release asset set must contain only its own binaries, SBOMs and signed checksums.v0.11.0-beta(run 38395147991) shows the failure and the straydeslop-report.*/DataProvider-build.cyclonedx.jsonassets this removes.Breaking Changes