From d4118a87aa0864da42bd0a8872570de9a7b08237 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Wed, 29 Jul 2026 18:36:10 +0530 Subject: [PATCH] SK-3023 guard internal-release against the automated bump commit (main) #378 merged the earlier skip-ci version before it was converted to the guard, so main is still on the bandage and inconsistent with the v3 line. This switches main to the scoped guard: the release job is skipped when the triggering push's head commit is an automated bump, so the PAT-authored bump cannot re-trigger the release, without globally skipping CI. - internal-release.yml: add the head-commit guard on the automated bump marker - shared-build-and-deploy.yml: drop the skip-ci suffix from the bump commit --- .github/workflows/internal-release.yml | 4 ++++ .github/workflows/shared-build-and-deploy.yml | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/internal-release.yml b/.github/workflows/internal-release.yml index e8b8ee61..5efee14f 100644 --- a/.github/workflows/internal-release.yml +++ b/.github/workflows/internal-release.yml @@ -10,6 +10,10 @@ on: jobs: build-and-deploy: + # Skip the automated version-bump commit so it can't re-trigger this workflow. + # The bump is pushed with a PAT (which, unlike GITHUB_TOKEN, DOES trigger workflows), + # so without this guard the release loops: bump -> push -> release -> bump -> ... + if: ${{ !contains(github.event.head_commit.message, '[AUTOMATED]') }} uses: ./.github/workflows/shared-build-and-deploy.yml with: ref: ${{ github.ref_name }} diff --git a/.github/workflows/shared-build-and-deploy.yml b/.github/workflows/shared-build-and-deploy.yml index 89e6e8b4..34e87d0d 100644 --- a/.github/workflows/shared-build-and-deploy.yml +++ b/.github/workflows/shared-build-and-deploy.yml @@ -106,10 +106,11 @@ jobs: git add pom.xml if [[ "${{ inputs.tag }}" == "internal" ]]; then - # [skip ci]: the version-bump push uses a PAT (see checkout above), and PAT-authored - # pushes DO trigger workflows (unlike GITHUB_TOKEN). Without this marker the push - # re-triggers this same internal-release workflow -> bump -> push -> infinite loop. - git commit -m "[AUTOMATED] Private Release ${{ steps.previoustag.outputs.tag }}-dev-$(git rev-parse --short $GITHUB_SHA) [skip ci]" + # The '[AUTOMATED]' marker is what stops the release loop: internal-release.yml + # skips any push whose head commit contains it (the bump is pushed with a PAT, + # which — unlike GITHUB_TOKEN — DOES trigger workflows). Keep the marker in sync + # with that guard. This keeps PR CI intact (no global skip). + git commit -m "[AUTOMATED] Private Release ${{ steps.previoustag.outputs.tag }}-dev-$(git rev-parse --short $GITHUB_SHA)" git push origin ${{ github.ref_name }} -f fi if [[ "${{ inputs.tag }}" == "beta" || "${{ inputs.tag }}" == "public" ]]; then