From 4d43687333b4ab4ae06a39c244a26b3ce99613bf Mon Sep 17 00:00:00 2001 From: Wayne Sun Date: Tue, 25 Aug 2026 17:31:38 -0400 Subject: [PATCH 1/2] =?UTF-8?q?ci(release):=20prepare=20v0.38.0=20?= =?UTF-8?q?=E2=80=94=20bump=20agents=20gate=20pin=20past=20agents#1010,=20?= =?UTF-8?q?tag=20the=20gate-validated=20SHA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Preparation for the next release (v0.38.0). Bump validate-agents' reusable-workflow pin from a8566cd5 to agents main b9c07455, which includes agents#1010: the gate now checks out fullsend-ai/agents at an explicit ref instead of github.workflow_sha (the caller's commit), so a cross-repo call can validate for the first time (fullsend#6512 §2, proven on the v0.37.0 run), and it exposes the validated SHA as the agents_sha workflow_call output. tag-agents now tags that gate-validated SHA, falling back to the SHA resolve-agents captured at release start only if the gate output is empty, and logs which source it used. This closes the resolve-once loop end to end: the tree the gate validated is the tree that gets tagged. The pin-drift check stays informational; the checks: read grant that was pre-granted in #6513 is now exercised by the roll-up job. Signed-off-by: Wayne Sun --- .github/workflows/release.yml | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bf869b46ef..0d2988c052 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -64,16 +64,13 @@ jobs: # id-token: write — GCP WIF auth in functional-tests # pull-requests: write — gate job (pull_request_target only; skipped # on tag pushes, but still validated) - # checks: read — functional-tests-complete roll-up on agents - # main (not used by the pinned gate yet; - # granted now so a pin bump cannot - # reintroduce the startup failure) + # checks: read — functional-tests-complete roll-up job permissions: contents: read id-token: write pull-requests: write checks: read - uses: fullsend-ai/agents/.github/workflows/functional-tests.yml@a8566cd5305fe094b96588690118022967ad0061 # main + uses: fullsend-ai/agents/.github/workflows/functional-tests.yml@b9c0745580084af09d1f1e2df8448d1d478458c6 # main (includes agents#1010 cross-repo checkout fix) with: fullsend_ref: ${{ github.ref_name }} secrets: @@ -85,13 +82,11 @@ jobs: EVAL_GH_TOKEN: ${{ secrets.EVAL_GH_TOKEN }} resolve-agents: - # Resolve the agents tree to tag exactly once, when the release starts. - # tag-agents previously re-resolved agents main at tag time, so anything - # merged into agents while the gate ran was tagged unvalidated (#6512). - # Until the agents gate exposes the SHA it checked out as a - # workflow_call output, validate-agents still exercises the pinned - # gate's agents tree; this at least makes the tagged tree deterministic - # from the moment the release begins. + # Resolve agents main once at release start. Since agents#1010 the gate + # itself reports the SHA it validated (validate-agents' agents_sha + # output), and tag-agents prefers that; this job's resolution is the + # fallback if that output is ever empty, and the input for the + # informational pin-drift check below (#6512). needs: release runs-on: ubuntu-24.04 timeout-minutes: 5 @@ -129,8 +124,10 @@ jobs: # Sync the version tag to fullsend-ai/agents. Runs for all tags # including pre-releases — agents' own release.yml handles # pre-release semantics. Only runs after agents functional tests - # pass against the release tag. Tags the SHA resolve-agents captured - # at release start — never re-resolves main here (#6512). + # pass against the release tag. Tags the SHA the gate actually + # validated (validate-agents' agents_sha output, agents#1010), falling + # back to the SHA resolve-agents captured at release start — never + # re-resolves main here (#6512). needs: [release, validate-agents, resolve-agents] runs-on: ubuntu-24.04 timeout-minutes: 5 @@ -148,13 +145,19 @@ jobs: - name: Push tag to fullsend-ai/agents env: GH_TOKEN: ${{ steps.agents-token.outputs.token }} - AGENTS_SHA: ${{ needs.resolve-agents.outputs.agents_sha }} + GATE_SHA: ${{ needs.validate-agents.outputs.agents_sha }} + RESOLVED_SHA: ${{ needs.resolve-agents.outputs.agents_sha }} run: | set -euo pipefail + AGENTS_SHA="${GATE_SHA:-${RESOLVED_SHA}}" if [[ ! "${AGENTS_SHA}" =~ ^[a-f0-9]{40}$ ]]; then - echo "::error::resolve-agents output is not a commit SHA: ${AGENTS_SHA//::/}" + echo "::error::no usable agents SHA (gate='${GATE_SHA//::/}' resolved='${RESOLVED_SHA//::/}')" exit 1 fi + if [[ -n "${GATE_SHA}" && "${GATE_SHA}" != "${RESOLVED_SHA}" ]]; then + echo "::notice::tagging the gate-validated SHA ${GATE_SHA} (agents main was ${RESOLVED_SHA} at release start)" + fi + echo "Tagging fullsend-ai/agents at ${AGENTS_SHA} (source: $([[ -n "${GATE_SHA}" ]] && echo validate-agents || echo resolve-agents))" TAG="${GITHUB_REF_NAME}" HTTP_CODE=$(gh api "repos/fullsend-ai/agents/git/ref/tags/${TAG}" \ From 7523c05fed56f4fd2d0b9c9e66d517e5c939be19 Mon Sep 17 00:00:00 2001 From: Wayne Sun Date: Thu, 27 Aug 2026 14:40:40 -0400 Subject: [PATCH 2/2] ci(release): bump agents gate pin to latest main Assisted-by: Codex Signed-off-by: Wayne Sun --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0d2988c052..c112443369 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -70,7 +70,7 @@ jobs: id-token: write pull-requests: write checks: read - uses: fullsend-ai/agents/.github/workflows/functional-tests.yml@b9c0745580084af09d1f1e2df8448d1d478458c6 # main (includes agents#1010 cross-repo checkout fix) + uses: fullsend-ai/agents/.github/workflows/functional-tests.yml@beed20e7e85f7f7cf9678a78fd1f440755560ca3 # main (includes agents#1010 cross-repo checkout fix) with: fullsend_ref: ${{ github.ref_name }} secrets: