From 8cf58a0f1fe86e585d345866d6356dbc15e7b2f1 Mon Sep 17 00:00:00 2001 From: ahall Date: Mon, 6 Jul 2026 12:45:16 +0100 Subject: [PATCH] fix: stop gating sign/release jobs and package version on github.ref for release events (#495) github.ref/GITHUB_REF was observed empty on 'release: published' events (runs 28783150142 and 27936434216), which silently skipped the sign and release jobs (string-matched against github.ref) and produced a wrong package version (GetBuildVersion fell back to the main-branch build number path). - Gate sign/release on github.event_name instead of github.ref string matching for the release event, while preserving existing behavior for push-to-main and workflow_dispatch manual recovery. - Pass github.event.release.tag_name explicitly into GetBuildVersion for release events instead of relying on $env:GITHUB_REF, so a blank ref can't silently produce a wrong package version. --- .github/workflows/build-library.yml | 22 ++++++++++++++++++---- .github/workflows/build-template.yml | 22 ++++++++++++++++++---- 2 files changed, 36 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-library.yml b/.github/workflows/build-library.yml index a74d367..c73cf17 100644 --- a/.github/workflows/build-library.yml +++ b/.github/workflows/build-library.yml @@ -52,10 +52,15 @@ jobs: uses: actions/checkout@v6 - name: Get build version + env: + RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} run: | Import-Module .\tools\GetBuildVersion.psm1 - Write-Host "GitHub Reference = $($env:GITHUB_REF)" - $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $env:GITHUB_REF -BuildNumber $env:GITHUB_RUN_NUMBER + # github.ref / $env:GITHUB_REF can be empty on 'release' events (see #495), so use the + # release's tag name directly instead of relying on ref resolution for that event. + $refString = if ($env:GITHUB_EVENT_NAME -eq 'release') { "refs/tags/$($env:RELEASE_TAG_NAME)" } else { $env:GITHUB_REF } + Write-Host "GitHub Reference = $refString" + $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $refString -BuildNumber $env:GITHUB_RUN_NUMBER echo "BUILD_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf-8 -Append Write-Host "BUILD_VERSION=$version" shell: pwsh @@ -138,7 +143,12 @@ jobs: sign: needs: [build] - if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }} + # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on + # 'release' events (see #495), which previously caused this job to be silently skipped. + if: >- + ${{ github.event_name == 'release' || + (github.event_name == 'push' && github.ref == 'refs/heads/main') || + (github.event_name == 'workflow_dispatch' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))) }} runs-on: windows-latest permissions: id-token: write @@ -205,7 +215,11 @@ jobs: --skip-duplicate release: - if: ${{ startsWith(github.ref, 'refs/tags/') }} + # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on + # 'release' events (see #495), which previously caused this job to be silently skipped. + if: >- + ${{ github.event_name == 'release' || + (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/')) }} needs: [ sign ] environment: nuget-release-gate runs-on: ubuntu-latest diff --git a/.github/workflows/build-template.yml b/.github/workflows/build-template.yml index 64e65ed..20af6af 100644 --- a/.github/workflows/build-template.yml +++ b/.github/workflows/build-template.yml @@ -36,10 +36,15 @@ jobs: uses: actions/checkout@v6 - name: Get build version + env: + RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} run: | Import-Module .\tools\GetBuildVersion.psm1 - Write-Host "GitHub Reference = $($env:GITHUB_REF)" - $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $env:GITHUB_REF -BuildNumber $env:GITHUB_RUN_NUMBER + # github.ref / $env:GITHUB_REF can be empty on 'release' events (see #495), so use the + # release's tag name directly instead of relying on ref resolution for that event. + $refString = if ($env:GITHUB_EVENT_NAME -eq 'release') { "refs/tags/$($env:RELEASE_TAG_NAME)" } else { $env:GITHUB_REF } + Write-Host "GitHub Reference = $refString" + $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $refString -BuildNumber $env:GITHUB_RUN_NUMBER echo "BUILD_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf-8 -Append Write-Host "BUILD_VERSION=$version" shell: pwsh @@ -82,7 +87,12 @@ jobs: sign: needs: [build] - if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }} + # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on + # 'release' events (see #495), which previously caused this job to be silently skipped. + if: >- + ${{ github.event_name == 'release' || + (github.event_name == 'push' && github.ref == 'refs/heads/main') || + (github.event_name == 'workflow_dispatch' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))) }} runs-on: windows-latest permissions: id-token: write @@ -149,7 +159,11 @@ jobs: --skip-duplicate release: - if: ${{ startsWith(github.ref, 'refs/tags/') }} + # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on + # 'release' events (see #495), which previously caused this job to be silently skipped. + if: >- + ${{ github.event_name == 'release' || + (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/')) }} needs: [ sign ] environment: nuget-release-gate runs-on: ubuntu-latest