From e1051ceea3027d668686ed266bb211e5d953c457 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Thu, 20 Aug 2026 06:01:09 -0700 Subject: [PATCH] fix(release): dispatch validation by full SHA (#126669) --- scripts/full-release-validation-at-sha.mts | 4 ++-- test/scripts/full-release-validation-at-sha.test.ts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/full-release-validation-at-sha.mts b/scripts/full-release-validation-at-sha.mts index db5e50b63406..058ffc3e5ed3 100644 --- a/scripts/full-release-validation-at-sha.mts +++ b/scripts/full-release-validation-at-sha.mts @@ -75,7 +75,7 @@ function usage() { console.error(`Usage: node scripts/full-release-validation-at-sha.mjs [--sha ] [--target-ref ] [--workflow-sha ] [--keep-branch] [--dry-run] [-- -f key=value ...] Creates temporary remote branches pinned to the exact Tooling SHA and Validation SHA, -dispatches Full Release Validation with the Validation SHA branch as its ref input +dispatches Full Release Validation with the full Validation SHA as its ref input and expected_sha as its immutable identity, watches the parent run, verifies all child workflow head SHAs match the trusted workflow lineage through the release evidence manifest, then deletes both @@ -674,7 +674,7 @@ function main() { const targetBranch = `validation/target-${targetSha.slice(0, 12)}-${Date.now()}`; const remoteTargetBranchRef = `refs/heads/${targetBranch}`; const dispatchInputs = { - ref: targetBranch, + ref: targetSha, expected_sha: targetSha, ...(targetContextRef !== targetSha ? { target_context_ref: targetContextRef } : {}), ...args.inputs, diff --git a/test/scripts/full-release-validation-at-sha.test.ts b/test/scripts/full-release-validation-at-sha.test.ts index d53906ff87d8..d160463e7339 100644 --- a/test/scripts/full-release-validation-at-sha.test.ts +++ b/test/scripts/full-release-validation-at-sha.test.ts @@ -515,7 +515,7 @@ describe("full-release-validation-at-sha", () => { ).toBe(false); }); - it("pushes an exact target ref, dispatches it, prints the run URL, and cleans both refs", () => { + it("pushes the target transport ref, dispatches the candidate SHA, and cleans both refs", () => { const fixture = createDispatchFixture(); try { const result = fixture.run(["--workflow-sha", fixture.workflowSha]); @@ -563,7 +563,7 @@ describe("full-release-validation-at-sha", () => { dispatchInputs[assignment.slice(0, separatorIndex)] = assignment.slice(separatorIndex + 1); } expect(dispatchInputs).toMatchObject({ - ref: targetBranch, + ref: fixture.targetSha, expected_sha: fixture.targetSha, target_context_ref: fixture.releaseRef, allow_unreleased_changelog: "false",