From 254ceda12178f72798933b5d5b68fb19f239f002 Mon Sep 17 00:00:00 2001 From: Jalil Date: Tue, 10 Nov 2026 16:10:20 -0800 Subject: [PATCH] ci(release): run the checks before a tag publishes anything The release workflow starts on any `v*` tag and went straight to building and publishing binaries, the chart and the images. A tag can be pushed on any commit, so a release could be published from code CI never checked. A `verify` job now runs gofmt, vet, the Go tests (default and experimental builds) and the Helm lint, and the `binaries` and `images` jobs need it. Not verified: the workflow runs only when a tag is pushed. The YAML parses and the make targets it calls pass locally. Co-Authored-By: Claude Fable 5.2 Signed-off-by: Jalil --- .github/workflows/release.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4a2112..b36400d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,23 @@ permissions: attestations: write jobs: + # Nothing is published from a tag whose code does not pass the checks CI + # runs: a tag can be pushed on any commit, checked or not. + verify: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - name: gofmt, vet and tests (default and experimental builds) + run: make fmt-check vet test experimental + - uses: azure/setup-helm@v4 + - name: helm lint + run: make helm-lint + binaries: + needs: verify runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -66,6 +82,7 @@ jobs: dist/differently.spdx.json images: + needs: verify runs-on: ubuntu-latest strategy: matrix: