Verify GitHub release before handing to post-release workflow

Merged
MA
2mo ago
+737-14

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • This change requires a documentation update

Description

create-release now reads the GitHub release back from GitHub instead of trusting gh's exit status. This ensures the tag handed to the post-release-workflow is one that was verified to be complete and correctly configured.

Why this matters: gh release create can succeed even if the asset upload fails, leaving a release without its checksum manifest. The next step (post-release workflow) publishes docs and images against the release, so it must be complete and correctly flagged. This change verifies:

  1. The release exists on the expected tag
  2. The release is published (not a draft)
  3. The release is flagged correctly (prerelease status matches what was requested)
  4. The release is titled correctly
  5. The checksum manifest is attached at the correct size (if one was built)

Re-run behavior: A re-run of a release whose tag already has a release verifies it the same way. A missing or stale manifest (from an attempt that died during asset upload) is the one partial state a re-run finishes by itself — it uploads the manifest again. A release that is drafted, flagged, or titled differently is one this run did not make, and it stops the job for a human to inspect rather than being passed off as this version's release.

Changes

  • Added helper functions to read and validate GitHub releases:

    • _release_view(): reads release metadata from GitHub
    • _metadata_problems(): validates release matches requested configuration
    • _checksum_asset_problem(): validates checksum manifest is attached correctly
    • _accept_existing_release(): handles re-run scenarios with existing releases

  • Updated cmd_create_release() to:

    • Check for existing releases before creating
    • Read back the created release from GitHub
    • Validate the release is complete and correctly configured
    • Provide clear error messages when validation fails

  • Added comprehensive test coverage for all validation scenarios:

    • Successful release creation and verification
    • Handling of missing/unparseable release metadata
    • Rejection of releases with incorrect metadata
    • Rejection of incomplete checksum assets
    • Safe re-run when release already matches
    • Finishing incomplete uploads from failed attempts
    • Rejection of stale releases not made by this run

  • Updated README documentation to explain the verification process and re-run behavior

Test Plan

All new functionality is covered by 11 new test cases in tests/units/reflex_release/test_commands.py:

  • test_create_release_reports_the_verified_release
  • test_create_release_fails_when_the_release_cannot_be_read_back
  • test_create_release_rejects_unparseable_release_metadata
  • test_create_release_rejects_a_release_that_is_not_the_one_asked_for (4 parameterized cases)
  • test_create_release_rejects_an_incomplete_checksum_asset (3 parameterized cases)
  • test_create_release_skips_a_matching_existing_release
  • test_create_release_attaches_a_manifest_an_earlier_attempt_left_off
  • test_create_release_fails_when_attaching_the_manifest_does_not_take
  • test_create_release_refuses_to_reuse_a_stale_release (3 parameterized cases)
  • test_create_release_reuses_a_release_without_a_local_manifest

Existing tests continue to pass with the updated release_args fixture, which now simulates the full release lifecycle including verification.

https://claude.ai/code/session_01KRAGNRmLGo2g59foKazSb9