fix(release): pin rehearsal preflight to branch head

This commit is contained in:
Dallin Romney
2026-07-09 21:02:21 -07:00
parent 7fd4c0f29b
commit 0d80b1bdab
2 changed files with 8 additions and 0 deletions
@@ -63,6 +63,7 @@ jobs:
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
WORKFLOW_REF: ${{ github.ref }}
WORKFLOW_SHA: ${{ github.sha }}
run: |
set -euo pipefail
if [[ "${PREFLIGHT_ONLY}" != "true" ]]; then
@@ -85,6 +86,10 @@ jobs:
echo "This throwaway workflow must run from dev/throwaway-2026.0.33-v6.8."
exit 1
fi
if [[ "${RELEASE_REF,,}" != "${WORKFLOW_SHA,,}" ]]; then
echo "This throwaway workflow requires tag to equal the selected branch head SHA."
exit 1
fi
- name: Checkout
uses: actions/checkout@v6
@@ -80,6 +80,9 @@ describe("minimal npm extended-stable workflow", () => {
expect(refGuard.run).toContain("requires a full 40-character commit SHA");
expect(refGuard.run).toContain("dev/throwaway-2026.0.33-v6.8");
expect(refGuard.run).toContain("requires preflight_only=true");
expect(refGuard.env?.WORKFLOW_SHA).toBe("${{ github.sha }}");
expect(refGuard.run).toContain('"${RELEASE_REF,,}" != "${WORKFLOW_SHA,,}"');
expect(refGuard.run).toContain("requires tag to equal the selected branch head SHA");
expect(parsed.jobs?.reject_non_preflight?.if).toBe("${{ !inputs.preflight_only }}");
expect(step(parsed.jobs?.reject_non_preflight, "Reject publish-mode dispatch").run).toContain(
"publish jobs are absent",