Enforce full release gates and require tags from main #44

New Issue

2026-07-14T17:42:18Z

KofTwentyTwo commented

2026-07-14 17:42:18 +00:00

(Migrated from github.com)

Problem

The tag-triggered release workflow can publish an arbitrary matching tag without proving that its commit is contained in main. It also runs a narrower validation set than normal CI: the release job builds the solution and runs only gclo.Engine.Tests, while normal CI additionally enforces CLI coverage, the coverage threshold, UI smoke tests, and formatting.

This allows an immutable public release to be created from a commit or regression that would not pass the repository's normal contribution gates.

Evidence

Tag trigger accepts every matching version tag: .github/workflows/release.yml:10-13.
Release validation builds and runs only the Engine suite: .github/workflows/release.yml:61-66.
Normal CI applies the broader build, coverage, CLI, UI, and formatting gates: .github/workflows/ci.yml:34-135.

This finding was independently verified at commit 119ac26804ef93b98a262cb1c0c7a41afe71fde5. It is related to the release findings collected in #32, but is tracked separately so it can be implemented and closed independently.

Acceptance criteria

The release workflow verifies that the tagged commit is contained in main before building or publishing artifacts.
Release artifacts depend on the same build, Engine/ViewModels, CLI, coverage, and formatting gates used by normal CI.
The Windows UI smoke gate is either required before publishing or an explicit, documented exception with an equivalent packaged-app launch smoke test.
Publishing jobs cannot run when any required validation job fails or is skipped unexpectedly.
Workflow changes pass syntax validation and include a testable failure path for a tag not contained in main.

## Problem The tag-triggered release workflow can publish an arbitrary matching tag without proving that its commit is contained in `main`. It also runs a narrower validation set than normal CI: the release job builds the solution and runs only `gclo.Engine.Tests`, while normal CI additionally enforces CLI coverage, the coverage threshold, UI smoke tests, and formatting. This allows an immutable public release to be created from a commit or regression that would not pass the repository's normal contribution gates. ## Evidence - Tag trigger accepts every matching version tag: `.github/workflows/release.yml:10-13`. - Release validation builds and runs only the Engine suite: `.github/workflows/release.yml:61-66`. - Normal CI applies the broader build, coverage, CLI, UI, and formatting gates: `.github/workflows/ci.yml:34-135`. This finding was independently verified at commit `119ac26804ef93b98a262cb1c0c7a41afe71fde5`. It is related to the release findings collected in #32, but is tracked separately so it can be implemented and closed independently. ## Acceptance criteria - The release workflow verifies that the tagged commit is contained in `main` before building or publishing artifacts. - Release artifacts depend on the same build, Engine/ViewModels, CLI, coverage, and formatting gates used by normal CI. - The Windows UI smoke gate is either required before publishing or an explicit, documented exception with an equivalent packaged-app launch smoke test. - Publishing jobs cannot run when any required validation job fails or is skipped unexpectedly. - Workflow changes pass syntax validation and include a testable failure path for a tag not contained in `main`.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#44