From 7656bd5f0a4b7496f41d71b5ee490c34366c7f63 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 14 Sep 2026 16:12:17 -0400 Subject: [PATCH] ci: skip the R2 publish for non-tag builds instead of failing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nclaw's Desktop Windows Build succeeded on main today (run 34888596818, the first green desktop build in weeks). Two seconds later this workflow fired on its workflow_run and went red: ::error::Resolved tag 'main' does not look like a version tag (expected vX.Y.Z...). Refusing to publish. The refusal is correct — a branch build is not a release and must not be published. The exit code is not: it turns every successful non-tag desktop build into a red X on main, and it will recur on each one now that those builds pass. Require the upstream run to be a tag build in the job's own `if`, so the job skips rather than starts and fails. head_branch carries the tag name for a tag-triggered upstream run and the branch name otherwise, which is exactly the discriminator needed. This mirrors the convention linux-sign.yml already documents for its gate-open state: a bare red X reads as "something is broken" when the real state is "nothing to publish here." The in-step validation stays. It still catches a malformed workflow_dispatch input such as "1.4.0", which the job-level check deliberately does not gate. --- .github/workflows/publish-r2.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-r2.yml b/.github/workflows/publish-r2.yml index cb12969..ef4d08f 100644 --- a/.github/workflows/publish-r2.yml +++ b/.github/workflows/publish-r2.yml @@ -25,7 +25,21 @@ jobs: # Only run for a successful upstream build, or an explicit manual dispatch — # never a failed/cancelled upstream run, which would otherwise publish # whatever partial artifacts that run happened to produce. - if: (github.event.workflow_run.conclusion == 'success') || (github.event_name == 'workflow_dispatch') + # + # Also require the upstream run to be a TAG build. The upstream workflows + # run on ordinary branch pushes too, and "Resolve and validate release + # version" below correctly refuses to publish those — but it did so with + # exit 1, which turned every successful non-tag desktop build into a red X + # on main. Refusing to publish something that was never publishable is not + # a failure; skip the job instead, the same way linux-sign.yml treats its + # own gate-open state rather than showing a bare red X. + # + # head_branch carries the tag name for a tag-triggered upstream run and the + # branch name otherwise, which is exactly the discriminator needed here. + if: >- + (github.event_name == 'workflow_dispatch') || + (github.event.workflow_run.conclusion == 'success' && + startsWith(github.event.workflow_run.head_branch, 'v')) runs-on: ubuntu-22.04 timeout-minutes: 20 steps: