From f0c77cdbc36b9a4bbe9d8896304f1af28a7bdb7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dongok=20Kim=20=28=EA=B9=80=EB=8F=99=EC=98=A5=29?=
 <do.kim@pubg.com>
Date: Thu, 16 Jul 2026 11:51:46 +0900
Subject: [PATCH] ci: support fork build tags with commit sha suffix
 (vX.Y.Z-<sha>)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fork releases reuse upstream version numbers plus a commit sha suffix
(e.g. v1.15.2-9bc0505b) so they never collide with upstream version
tags. Trigger the release pipeline on such tags and strip the suffix
in the upgrade suite version check, which compares tags against the
in-tree version that never carries it.

Signed-off-by: Dongok Kim (김동옥) <do.kim@pubg.com>
---
 .github/workflows/release_build.yaml               |  4 ++++
 .../upgrade/02-verify-codebase-version-is-updated  | 14 +++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release_build.yaml b/.github/workflows/release_build.yaml
index f5a2b47684..57ba3331aa 100644
--- a/.github/workflows/release_build.yaml
+++ b/.github/workflows/release_build.yaml
@@ -3,6 +3,10 @@ on:
   push:
     tags:
       - 'v[0-9].[0-9]+.[0-9]+'
+      # Fork build tags: upstream version + commit sha suffix
+      # (e.g. v1.15.2-9bc0505b). Keeps fork releases from colliding with
+      # upstream version tags while reusing the same release pipeline.
+      - 'v[0-9].[0-9]+.[0-9]+-[0-9a-f]+'
 
 permissions: {}
 
diff --git a/test/integration/suites/upgrade/02-verify-codebase-version-is-updated b/test/integration/suites/upgrade/02-verify-codebase-version-is-updated
index defa8a5fb0..e02c81b805 100755
--- a/test/integration/suites/upgrade/02-verify-codebase-version-is-updated
+++ b/test/integration/suites/upgrade/02-verify-codebase-version-is-updated
@@ -2,6 +2,14 @@
 
 git="git --git-dir ${REPODIR}/.git"
 
+# Fork build tags append a commit sha suffix to the upstream version
+# (e.g. v1.15.2-9bc0505b) so fork releases don't collide with upstream
+# version tags. Strip the suffix before comparing against the codebase
+# version, which never carries it.
+strip-build-sha() {
+    sed -E 's/-[0-9a-f]{7,40}$//'
+}
+
 check-version-against-latest-release() {
     _commit_version="$1"
     _default_branch="origin/$($git remote show origin | grep 'HEAD branch' | cut -d":" -f2 | xargs)"
@@ -27,12 +35,12 @@ check-version-against-latest-release() {
 
     if [ "${_version_from_branch}" = "${_default_branch}" ]; then
         # The default branch should use the latest release tag from the repo
-        _latest_version=$($git tag --list 'v*' --sort -version:refname | head -n1 | cut -c 2-)
+        _latest_version=$($git tag --list 'v*' --sort -version:refname | head -n1 | cut -c 2- | strip-build-sha)
         log-info "latest release: ${_latest_version}"
     else
         # Non-default branches should have aligned version with the latest
         # release from that branch. So we'll scan for the latest tag.
-        _latest_version=$($git describe --match "v*" --abbrev=0 "${_version_from_branch}"| cut -c 2-)
+        _latest_version=$($git describe --match "v*" --abbrev=0 "${_version_from_branch}"| cut -c 2- | strip-build-sha)
         log-info "latest release from ${_version_from_branch}: ${_latest_version}"
     fi
 
@@ -52,7 +60,7 @@ _commit_version=$(docker compose exec -T -e DD_TRACE_STARTUP_LOGS=false spire-se
 docker-down
 
 # Get tag of the current commit
-_current_tag=$($git describe --exact-match HEAD --match "v*"  2> /dev/null | cut -c 2- || true)
+_current_tag=$($git describe --exact-match HEAD --match "v*"  2> /dev/null | cut -c 2- | strip-build-sha || true)
 
 case "${_current_tag}" in