fix(ci): refuse a release tag that is not on main #16

Merged

jlxq0 merged 1 commit from enforce-tag-on-main into main

2026-09-07 05:11:49 +00:00

jlxq0 commented

2026-09-07 05:10:57 +00:00

Owner

Closes the hole clark named on platform#779. Skipping the Quality gate on tags is sound only while every tag names a commit already gated on main, and a skipped job reports success, so an ungated tag would publish with a green status and nothing to catch it. The docker job now compares main...<tagged sha> and refuses unless total_commits == 0 (the commit is on main), failing closed if the count is unreadable. Cheap enforcement, not a re-run of the gate (which is what fails cold).

Closes the hole clark named on platform#779. Skipping the Quality gate on tags is sound only while every tag names a commit already gated on main, and a skipped job reports `success`, so an ungated tag would publish with a green status and nothing to catch it. The docker job now compares `main...<tagged sha>` and refuses unless `total_commits == 0` (the commit is on main), failing closed if the count is unreadable. Cheap enforcement, not a re-run of the gate (which is what fails cold).

jlxq0 added 1 commit

2026-09-07 05:10:57 +00:00

fix(ci): refuse a release tag that is not on main

CI / Quality gate (pull_request) Successful in 16s

Details

CI / Build and push image (pull_request) Has been skipped

Details

49126887ff

Closes the hole in skipping the Quality gate on tags: the skip is only sound
while every tag names a commit already gated on main, and a skipped job reports
success, so an ungated tag would publish with a green status and nothing to
catch it. The docker job now compares main...<tagged sha> and refuses unless
the commit is on main (total_commits == 0), failing closed if the count cannot
be read. Named by clark on platform#779.

jlxq0 merged commit 03c054cb29 into main

2026-09-07 05:11:49 +00:00

jlxq0 deleted branch enforce-tag-on-main

2026-09-07 05:11:49 +00:00

jlxq0 referenced this pull request from a commit

2026-09-07 05:11:50 +00:00

Merge pull request 'fix(ci): refuse a release tag that is not on main' (#16) from enforce-tag-on-main into main