From 96270271605b9a8ce871d75f84d15f9acaef5ed2 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Apr 2026 14:48:06 +0000 Subject: [PATCH] Pin release.yml checkout ref to refs/tags/ on workflow_dispatch When workflow_dispatch was invoked with a branch name (e.g. "main"), actions/checkout would silently resolve it as a branch ref and later steps that assume HEAD is a release tag (git describe --tags --exact-match HEAD, gh release create --verify-tag, etc.) would fail with confusing errors. Resolve inputs.tag_name via format('refs/tags/{0}', inputs.tag_name) in both the release and nuget-publish jobs so a branch name now fails the checkout step itself instead of reaching the tag-assumed downstream logic. https://claude.ai/code/session_01EynRk1KiNDypBTkzJgwfVT --- .github/workflows/release.yml | 12 ++++++++++-- CHANGELOG.md | 8 ++++++++ .../Architecture/CiAutomationConfigurationTests.cs | 14 ++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9d9a6678..8d44a069 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,13 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - ref: ${{ inputs.tag_name || github.ref }} + # On workflow_dispatch, force refs/tags/ so a branch name + # (e.g. "main") fails checkout instead of falling through to the + # tag-assumed downstream steps. + # workflow_dispatch では refs/tags/ に固定し、"main" 等の + # ブランチ名が指定された場合にタグ前提の後続ステップへ進む前に + # checkout 段階で失敗させます。 + ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }} - name: Set up .NET uses: actions/setup-dotnet@v4 @@ -149,7 +155,9 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - ref: ${{ inputs.tag_name || github.ref }} + # See release job for rationale. + # release ジョブの注記を参照してください。 + ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }} - name: Set up .NET uses: actions/setup-dotnet@v4 diff --git a/CHANGELOG.md b/CHANGELOG.md index 89ab3788..85299fd7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), ### [Unreleased] +#### Fixed + +- **Release workflow `workflow_dispatch` now pins the checkout to `refs/tags/`** — Both the `release` and `nuget-publish` jobs in `.github/workflows/release.yml` now resolve the dispatch `tag_name` input via `format('refs/tags/{0}', inputs.tag_name)`. Supplying a branch name (for example `main`) now fails at the `actions/checkout` step instead of falling through into the tag-assumed downstream logic (`git describe --tags --exact-match HEAD`, `gh release create --verify-tag`, etc.) and producing confusing late-stage failures. Tag-push triggers still fall through to `github.ref` unchanged. Affected: `.github/workflows/release.yml`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`. Tests: `CiAutomationConfigurationTests.cs` (1 updated). + ### [1.17.0] - 2026-04-17 #### Changed @@ -1440,6 +1444,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), ### [Unreleased] +#### 修正 + +- **リリースワークフローの `workflow_dispatch` は checkout を `refs/tags/` に固定** — `.github/workflows/release.yml` の `release` / `nuget-publish` ジョブは、dispatch 入力 `tag_name` を `format('refs/tags/{0}', inputs.tag_name)` で解決するようになりました。ブランチ名（例: `main`）が指定された場合は `actions/checkout` 段階で失敗するため、従来のようにタグ前提の後続処理（`git describe --tags --exact-match HEAD`、`gh release create --verify-tag` など）まで進んで混乱する失敗メッセージを出すことがなくなりました。タグ push 起点の実行はこれまで通り `github.ref` を利用します。対象: `.github/workflows/release.yml`、`FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`。テスト: `CiAutomationConfigurationTests.cs`（更新 1 件）。 + ### [1.17.0] - 2026-04-17 #### 変更 diff --git a/FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs b/FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs index 23dfffb5..0d2eab8c 100644 --- a/FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs +++ b/FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs @@ -91,6 +91,20 @@ public void ReleaseWorkflow_CreatesGitHubReleaseFromVersionTags() workflow); Assert.Contains("CURRENT_TAG=$(git describe --tags --exact-match HEAD --match 'v*')", workflow, StringComparison.Ordinal); Assert.Contains("PREV_TAG=$(git describe --first-parent --tags --abbrev=0 HEAD^ --match 'v*' 2>/dev/null || true)", workflow, StringComparison.Ordinal); + // workflow_dispatch must resolve the tag input to refs/tags/ + // so that branch names (e.g. "main") fail at checkout instead of + // falling through into tag-assumed downstream steps. + // workflow_dispatch では tag 入力を refs/tags/ に解決し、 + // "main" のようなブランチ名が指定された場合にタグ前提の後続ステップへ + // 進む前に checkout 段階で失敗させます。 + Assert.Contains( + "ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }}", + workflow, + StringComparison.Ordinal); + Assert.DoesNotContain( + "ref: ${{ inputs.tag_name || github.ref }}", + workflow, + StringComparison.Ordinal); Assert.DoesNotContain("Check if Core exists on GitHub Packages", workflow, StringComparison.Ordinal); Assert.DoesNotContain("Check if Plugin.Abstractions exists on GitHub Packages", workflow, StringComparison.Ordinal); Assert.DoesNotContain("owner_path=\"users\"", workflow, StringComparison.Ordinal);