.github/workflows/release.yml only triggers on push: tags: ["v*"]. Nothing else runs it, so any change to it — or to an action it depends on — is unverified until a real release is cut, and a failure there is public and hard to undo.
This is not hypothetical. Dependabot proposed bumping actions/download-artifact 4→8 (#57) and softprops/action-gh-release 2→3 (#58). Both showed green CI, and that green means nothing: neither action appears in ci.yml. Merging on that signal would have been merging on a check that never exercised the code. Both are being held for this reason. The v1.0.0 release run also failed historically, with v1.0.1 and v1.0.2 cut immediately after to fix CI issues — evidence that this path breaks in exactly the way an untested workflow does.
Options
workflow_dispatch on release.yml with a dry_run input that builds and packages every artifact but skips the publish job. Cheapest, and makes the release path runnable on demand.- A packaging job in
ci.yml that runs build.sh/build-linux.sh and asserts the artifacts exist with the right names, on PRs that touch build scripts, Dockerfile.linux, or release.yml (path filter). Catches breakage at PR time.
- Pre-release rehearsal on a
v*-rc* tag pattern publishing to a draft release.
Option 1 plus a path-filtered version of option 2 is probably the right combination.
Definition of done
.github/workflows/release.ymlonly triggers onpush: tags: ["v*"]. Nothing else runs it, so any change to it — or to an action it depends on — is unverified until a real release is cut, and a failure there is public and hard to undo.This is not hypothetical. Dependabot proposed bumping
actions/download-artifact4→8 (#57) andsoftprops/action-gh-release2→3 (#58). Both showed green CI, and that green means nothing: neither action appears inci.yml. Merging on that signal would have been merging on a check that never exercised the code. Both are being held for this reason. The v1.0.0 release run also failed historically, with v1.0.1 and v1.0.2 cut immediately after to fix CI issues — evidence that this path breaks in exactly the way an untested workflow does.Options
workflow_dispatchonrelease.ymlwith adry_runinput that builds and packages every artifact but skips thepublishjob. Cheapest, and makes the release path runnable on demand.ci.ymlthat runsbuild.sh/build-linux.shand asserts the artifacts exist with the right names, on PRs that touch build scripts,Dockerfile.linux, orrelease.yml(path filter). Catches breakage at PR time.v*-rc*tag pattern publishing to a draft release.Option 1 plus a path-filtered version of option 2 is probably the right combination.
Definition of done
release.yml, a build script, orDockerfile.linuxgets a check that actually runs the packaging.