ci: skip an existing X.Y.Z-rN built from the same Pin, whichever run comes first #33

Merged

piscis merged 1 commit from piscis/forgejo-7-same-pin-skip into main

2026-09-30 18:06:52 +00:00

piscis commented

2026-09-30 17:33:18 +00:00

Owner

Refs #7

Summary

When X.Y.Z-rN already exists, scripts/publish.sh now compares this run's Pin with the Pin the existing Image was built from. It no longer compares with the commit before the push, so the result doesn't depend on which run goes first.

 X.Y.Z-rN exists?
-  Pin differs from the push's "before" commit (a dispatch counts as unchanged) -> fail
-  otherwise                                                                    -> skip
+  rev := the existing Image's org.opencontainers.image.revision label
+  pin.env at rev == this run's pin.env (values only, no comments) -> skip, green
+  different, or rev missing/unknown                               -> fail

The "Did this push change the Pin?" step is gone from ci.yml, and publish.sh takes 3 arguments instead of 4.
A raised REBUILD with a stale REBUILD_OF still fails, because its Pin differs from the one the existing tag was built from.
The already published 3.2.0-r1 has revision=7f2e214 (the merge of #28), and its Pin matches main. So the next push to main skips it and stays green. I checked this locally against the real registry.

Evidence

I ran the real workflow on a throwaway branch that published to a test package (both are deleted now):

Run	Scenario	Result
#52	first publish 3.2.0-r1	green, published
#53	comment-only Pin edit	green, "already exists, built from the same Pin"
#54	`REBUILD=2`, `REBUILD_OF` stale, which still resolves to 3.2.0-r1	failed, and the log shows the Pin diff
#56–58	new tag 3.2.0-r2: a push plus 2 dispatches	all green. The dispatch #56 published first and the push #57 then skipped.

Before: in the same race (#46–48 on PR #28), the push run went red with "already exists, but this push changed the Pin".
After: #57 is green.

Merge Danger

Door: two-way

The change only affects what happens when a tag already exists. It never pushes where the old rule wouldn't have.

Blast Radius: CI

A tag whose Pin can't be read fails instead of being skipped, for example if its revision was on a branch that has since been deleted. Every tag published from main so far has a readable revision.

Refs #7 ## Summary When `X.Y.Z-rN` already exists, `scripts/publish.sh` now compares this run's Pin with the Pin the existing Image was built from. It no longer compares with the commit before the push, so the result doesn't depend on which run goes first. ```diff X.Y.Z-rN exists? - Pin differs from the push's "before" commit (a dispatch counts as unchanged) -> fail - otherwise -> skip + rev := the existing Image's org.opencontainers.image.revision label + pin.env at rev == this run's pin.env (values only, no comments) -> skip, green + different, or rev missing/unknown -> fail ``` - The "Did this push change the Pin?" step is gone from `ci.yml`, and `publish.sh` takes 3 arguments instead of 4. - A raised `REBUILD` with a stale `REBUILD_OF` still fails, because its Pin differs from the one the existing tag was built from. - The already published `3.2.0-r1` has `revision=7f2e214` (the merge of #28), and its Pin matches `main`. So the next push to `main` skips it and stays green. I checked this locally against the real registry. ## Evidence I ran the real workflow on a throwaway branch that published to a test package (both are deleted now): | Run | Scenario | Result | |---|---|---| | #52 | first publish 3.2.0-r1 | green, published | | #53 | comment-only Pin edit | green, "already exists, built from the same Pin" | | #54 | `REBUILD=2`, `REBUILD_OF` stale, which still resolves to 3.2.0-r1 | **failed**, and the log shows the Pin diff | | #56–58 | new tag 3.2.0-r2: a push plus 2 dispatches | all green. The dispatch #56 published first and the push #57 then skipped. | - **Before:** in the same race (#46–48 on PR #28), the push run went red with "already exists, but this push changed the Pin". - **After:** #57 is green. ## Merge Danger **Door:** two-way The change only affects what happens when a tag already exists. It never pushes where the old rule wouldn't have. **Blast Radius:** CI A tag whose Pin can't be read fails instead of being skipped, for example if its revision was on a branch that has since been deleted. Every tag published from `main` so far has a readable revision.

piscis added 1 commit

2026-09-30 17:33:18 +00:00

ci: skip an existing X.Y.Z-rN built from the same Pin, whichever run comes first (#7 )

ci / build (pull_request) Successful in 10s

Details

546d1b629e