Reuse Fedora CI results before sending COPR release webhook

.github/workflows/copr-release.yml

@@ -6,16 +6,49 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
-  validate:
-    uses: ./.github/workflows/fedora.yml
-
   copr:
-    needs: validate
     if: github.event_name == 'release' && !github.event.release.prerelease
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v7
+
+      - name: Check existing Fedora validation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(cat VERSION)
+          if [[ "$RELEASE_TAG" != "v$version" ]]; then
+            echo "::error::Release tag must be v$version"
+            exit 1
+          fi
+
+          commit=$(git rev-parse HEAD)
+          gh api --method GET \
+            "repos/$GITHUB_REPOSITORY/actions/workflows/fedora.yml/runs" \
+            -f head_sha="$commit" -f branch=main -f event=push \
+            -f per_page=100 > /tmp/fedora-runs.json
+
+          result=$(jq -r '
+            .workflow_runs
+            | sort_by(.run_number)
+            | last
+            | if . == null then "missing"
+              elif .status != "completed" then .status
+              else .conclusion
+              end
+          ' /tmp/fedora-runs.json)
+
+          if [[ "$result" != "success" ]]; then
+            echo "::error::Commit $commit has no successful Fedora push validation on main (status: $result). Wait for validation or fix it, then rerun this release workflow."
+            exit 1
+          fi
+
       - name: Notify COPR of the validated tag
         env:
           COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }}

.github/workflows/fedora.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-  workflow_call:
 
 permissions:
   contents: read
@@ -23,26 +22,14 @@ jobs:
           dnf -y builddep bb-auth.spec
       - name: Validate version and prepare sources
         shell: bash
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           set -euo pipefail
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           version=$(cat VERSION)
           spec_version=$(rpmspec -q --qf '%{VERSION}\n' bb-auth.spec | head -n1)
           test "$version" = "$spec_version"
           mkdir -p /tmp/rpmbuild/{SOURCES,SPECS,BUILD,BUILDROOT,RPMS,SRPMS}
-          if [[ "$GITHUB_EVENT_NAME" == release ]]; then
-            test "$RELEASE_TAG" = "v$version"
-            spectool -g -C /tmp/rpmbuild/SOURCES bb-auth.spec
-            # Ensure the tag archive matches the checkout being validated.
-            mkdir /tmp/release-source
-            tar -xf "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz" -C /tmp/release-source
-            git archive --prefix="bb-auth-$version/" HEAD | tar -x -C /tmp
-            diff -r "/tmp/bb-auth-$version" "/tmp/release-source/bb-auth-$version"
-          else
-            git archive --prefix="bb-auth-$version/" HEAD | gzip > "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz"
-          fi
+          git archive --prefix="bb-auth-$version/" HEAD | gzip > "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz"
       - name: Build RPM and run tests
         run: rpmbuild -ba --define '_topdir /tmp/rpmbuild' bb-auth.spec
       - name: Install RPM and check installed paths

docs/FEDORA_COPR.md

@@ -37,16 +37,17 @@ and `Version` in the spec together, commit, then create a GitHub release with
 the matching `vX.Y.Z` tag. Both workflows must exist in that tagged commit.
 
 `.github/workflows/fedora.yml` builds, tests, and installs an RPM in Fedora 44
-on pushes to `main` and pull requests. It also exposes `workflow_call` so the
-release workflow can reuse the same validation.
-
-`.github/workflows/copr-release.yml` runs when a release is published. It first
-calls `fedora.yml`, which downloads the release tag archive and checks that it
-matches the checkout before building/testing/installing the RPM. Only after
-validation succeeds does the release workflow send a tag-creation event to
-COPR. Prereleases are validated but do not trigger COPR. A failed validation
-prevents the webhook job from running. The release is validated independently
-of previous `main` runs, so COPR receives the tag that actually passed.
+on pushes to `main` and pull requests.
+
+`.github/workflows/copr-release.yml` runs when a stable release is published.
+It checks that the tag is `v<VERSION>` and queries the latest Fedora push run
+on `main` for the exact commit checked out from the release tag. Only a completed,
+successful run allows the COPR webhook. It does not rebuild the RPM or rerun tests.
+Prereleases are skipped. Missing, pending, failed, or cancelled validation blocks
+the webhook; finish or fix the Fedora validation, then rerun the release workflow.
+Publish releases after their commit passes validation on `main`. Pull-request
+validation alone does not qualify. GitHub API access uses the workflow token with
+`actions: read`; no additional secret is needed.
 
 COPR checks out the tag, reads its spec, and downloads the versioned archive
 to build the SRPM. A successful webhook request only means the request was