Skip to content

ci: allow optional upstream_tag override in Figma release workflow #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexeagle merged 1 commit into from
Aug 13, 2026
Merged

ci: allow optional upstream_tag override in Figma release workflow #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 21 additions & 8 deletions .github/workflows/figma-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,11 @@ on:
description: "Fork branch/tag/commit to build, named <upstream-version>-figma (e.g. 8.6.0-figma). The release version is derived automatically."
required: true
type: string
upstream_tag:
description: "Optional upstream tag to verify against and use as host Bazel (e.g. 8.8.0rc1 when the final release tag does not exist yet). Defaults to the derived base version."
required: false
type: string
default: ""

permissions:
contents: read
Expand All @@ -111,6 +116,7 @@ jobs:
outputs:
sha: ${{ steps.resolve.outputs.sha }}
base_version: ${{ steps.resolve.outputs.base_version }}
upstream_tag: ${{ steps.resolve.outputs.upstream_tag }}
version: ${{ steps.resolve.outputs.version }}
steps:
- name: Checkout ${{ inputs.ref }}
Expand Down Expand Up @@ -139,10 +145,14 @@ jobs:
fi

# 2. Sanity check: the ref must actually descend from upstream <base>.
upstream_tag='${{ inputs.upstream_tag }}'
if [ -z "$upstream_tag" ]; then
upstream_tag="$base"
fi
git remote add upstream https://github.com/bazelbuild/bazel.git 2>/dev/null || true
git fetch --no-tags upstream "refs/tags/${base}:refs/tags/upstream-${base}"
git fetch --no-tags upstream "refs/tags/${upstream_tag}:refs/tags/upstream-${base}"
if ! git merge-base --is-ancestor "upstream-${base}" HEAD; then
echo "::error::ref '$ref' does not descend from upstream Bazel ${base} — wrong base version?"
echo "::error::ref '$ref' does not descend from upstream Bazel ${upstream_tag} — wrong base version?"
exit 1
fi

Expand All @@ -166,11 +176,12 @@ jobs:
{
echo "sha=$sha"
echo "base_version=$base"
echo "upstream_tag=$upstream_tag"
echo "version=$version"
} >> "$GITHUB_OUTPUT"

echo "ref '$ref' @ ${sha:0:12}"
echo "upstream base: $base (host Bazel)"
echo "upstream base: $base (host Bazel: $upstream_tag)"
echo "previous figma build for $base: ${max:-none}"
echo "=> release version / tag: $version"

Expand Down Expand Up @@ -211,7 +222,7 @@ jobs:
env:
# Bazelisk reads this instead of the checked-in .bazelversion, so the
# host Bazel used to build always matches the upstream base version.
USE_BAZEL_VERSION: ${{ needs.setup.outputs.base_version }}
USE_BAZEL_VERSION: ${{ needs.setup.outputs.upstream_tag }}
VERSION: ${{ needs.setup.outputs.version }}
ARCH: ${{ matrix.arch }}
BAZELISK_ARCH: ${{ matrix.bazelisk_arch }}
Expand Down Expand Up @@ -320,7 +331,7 @@ jobs:

- name: Build Bazel
env:
USE_BAZEL_VERSION: ${{ needs.setup.outputs.base_version }}
USE_BAZEL_VERSION: ${{ needs.setup.outputs.upstream_tag }}
VERSION: ${{ needs.setup.outputs.version }}
run: |
set -euo pipefail
Expand Down Expand Up @@ -391,15 +402,17 @@ jobs:
env:
VERSION: ${{ needs.setup.outputs.version }}
BASE_VERSION: ${{ needs.setup.outputs.base_version }}
UPSTREAM_TAG: ${{ needs.setup.outputs.upstream_tag }}
run: |
set -euo pipefail
label="$VERSION"
base="$BASE_VERSION"
upstream_tag="$UPSTREAM_TAG"
ref='${{ inputs.ref }}'

# Fetch the upstream base tag so we can describe drift from upstream.
# Fetch the upstream tag so we can describe drift from upstream.
git remote add upstream https://github.com/bazelbuild/bazel.git 2>/dev/null || true
git fetch --no-tags upstream "refs/tags/${base}:refs/tags/upstream-${base}"
git fetch --no-tags upstream "refs/tags/${upstream_tag}:refs/tags/upstream-${base}"

upstream_sha="$(git rev-parse --short "upstream-${base}")"
head_sha="$(git rev-parse --short HEAD)"
Expand All @@ -412,7 +425,7 @@ jobs:
echo
echo "## Upstream base"
echo
echo "Forked from upstream Bazel **${base}** ([bazelbuild/bazel@\`${upstream_sha}\`](https://github.com/bazelbuild/bazel/releases/tag/${base}))."
echo "Forked from upstream Bazel **${base}** ([bazelbuild/bazel@\`${upstream_sha}\`](https://github.com/bazelbuild/bazel/releases/tag/${upstream_tag}))."

@cursor cursor Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Broken upstream compare link

Low Severity

When upstream_tag differs from the derived base version, release notes still build the compare URL and the “identical to upstream” text from base. For the intended pre-final-tag case that makes the delta link point at a nonexistent upstream tag, even though the notes elsewhere already use the resolved tag.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ecc26c0. Configure here.

echo
echo "## Figma commits on top of upstream"
echo
Expand Down
Loading