From d2f372990fb102c7d0725925b4b36087bd3c87f2 Mon Sep 17 00:00:00 2001 From: bdimitrov-netzine Date: Fri, 10 Jul 2026 11:32:29 +0300 Subject: [PATCH] fix(promote): correct git-tag existence check (422 misread as existing tag) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'Tag promoted commit' step used `gh api repos/$REPO/commits/$TAG` to resolve an existing tag to its commit. For a tag that does not exist, that endpoint returns HTTP 422 with a JSON error body; gh api prints the body to stdout and skips --jq, so `2>/dev/null || true` captured the raw JSON into CUR. A non-empty, non-matching CUR then tripped the never-move guard and the job failed with 'Refusing to move the tag' — even though the tag was absent. Switch the existence check to the refs API (git/ref/tags/$TAG), which cleanly 404s when the tag is missing, and only resolve the commit when it exists. Preserves the create-only / never-move / idempotent semantics. Observed on run 29075877856 (testnet-v1.2.2 promotion); the tag was created manually out-of-band so this only fixes the workflow going forward. --- .github/workflows/promote-docker.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/promote-docker.yml b/.github/workflows/promote-docker.yml index 8f6e2c4..8208b41 100644 --- a/.github/workflows/promote-docker.yml +++ b/.github/workflows/promote-docker.yml @@ -360,9 +360,9 @@ jobs: exit 0 fi - # Idempotent + never-move: resolve any existing tag to its commit. - CUR=$(gh api "repos/$REPO/commits/$TAG" --jq '.sha' 2>/dev/null || true) - if [ -n "$CUR" ]; then + # Idempotent + never-move + if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then + CUR=$(gh api "repos/$REPO/commits/$TAG" --jq '.sha') if [ "$CUR" = "$COMMIT" ]; then echo "Tag $TAG already points at $COMMIT — nothing to do." exit 0