ci(release): validate-first ordering + fix install-e2e/cli-e2e + install.sh curl bootstrap#3
Merged
Conversation
…publish; fix install.sh curl bootstrap The release pipeline released first and validated in parallel — backwards. Fix the ordering and the coupling: - release.yml: add a `validate` gate (go vet + race tests over the full module); every build job now `needs: validate`, so nothing is built or published unless tests pass. Release is genuinely the last step. - install-e2e.yml / cli-e2e.yml: these download the RELEASED binary, so move them off main-push (which raced the release cut — the old release was already deleted and the new one not yet published, so "latest" 404'd) onto `release: published`. They now validate the freshly-published artifacts. macOS/Windows CLI install jobs also run on release. - install.sh: a pre-existing bug (since the 2026-05-30 installer rewrite) — it calls curl to resolve the release BEFORE installing prerequisites, so minimal hosts/containers without curl failed with "curl: not found". Add ensure_downloader() to install curl up front (verified end-to-end via test/install/run-distro.sh debian12 against the published release). - CLAUDE.md: rewrite the release policy — validate first, release last, prune the OLD release AFTER the new one is live (never before).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix release ordering + the workflow failures from the v2026.06.02 cut
Two problems surfaced when cutting
v2026.06.02:1. Release ran before validation (the anti-pattern)
release.ymlbuilt + published immediately on tag push, in parallel with CI. Now it has avalidategate (go vet+ race tests over the full module); every build jobneeds: validate, so nothing is built or published unless tests pass. The release is genuinely the last step.2. install-e2e / cli-e2e raced the release cut → 404
These download the released binary, but triggered on main-push — so they ran during the window where the old release was already deleted and the new one wasn't published yet, and
GET /releases/latest404'd. Moved them torelease: publishedso they validate the freshly-published artifacts (no race). macOS/Windows CLI install jobs also run on release now.3. Pre-existing
install.shbug (since the 2026-05-30 installer rewrite)install.shcalledcurlto resolve the release before installing prerequisites, so minimal hosts/containers without curl failedcurl: not found— install-e2e has been red since 2026-05-30. Addedensure_downloader()to install curl up front. Verified end-to-end viatest/install/run-distro.sh debian12against the published release (install → service → health → smoke → uninstall all green).4. Policy
CLAUDE.mdrelease policy rewritten: validate first, release last, prune the OLD release AFTER the new one is live (deleting it first is what opened the 404 window).Verification
release.ymljob graph:validate→ allbuild-*→release/docker-manifest.install.sh:sh -nclean; debian12 install-e2e harness passes locally againstv2026.06.02.