Skip to content

Ci/align release gate - #8

Merged
sbokatuk merged 4 commits into
mainfrom
ci/align-release-gate
Jul 28, 2026
Merged

sbokatuk merged 4 commits into
mainfrom
ci/align-release-gate

Conversation

@sbokatuk

Copy link
Copy Markdown
Owner

No description provided.

sbokatuk and others added 3 commits July 28, 2026 16:56
Every repository already had the same skeleton — a version job, a reusable
build.yml, a publish job — but five different ways of telling build.yml "this
is a release, the checks already ran". Net.Agora used `track != ""`, the
Datadog and OpenTok repos used `build-sample` and `verify-release`, Red5Pro
inverted its `run-live-tiers` knob, and six repositories had no gate at all
and re-ran the entire pull-request pipeline on every tag.

Replaces all of it with one boolean input, `verify`, with the same name,
default and meaning everywhere. Pull requests leave it true and are the only
place verification runs; release.yml passes false. Across the eighteen
repositories that takes the build jobs a tag runs from 59 to 23 — the 23 being
pack, its prerequisites, and OpenTok.Net's add-windows-assets, which merges the
Windows heads into the packages being published and so is not a check.

The same rule now applies whether a check is a job or a step: the package
tests and sample compiles that lived inside pack jobs are gated too, since
where a check happened to be written should not decide whether it repeats.
Checks on the pins a pack consumed, or on the bytes it emitted, still run on a
release — they are cheap and they guard the artifact about to be published.

Skipping verification on a tag is only sound if the tagged commit really did
go through a pull request, so release.yml gains a guard job that fails when
the commit is not an ancestor of the default branch. OpenTok.Net.Android and
OpenTok.Net.iOS also gain the tag-versus-Directory.Build.props check their
sibling OpenTok.Net.Win already had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The tag was the only manual step left. A release note is already written by
hand, one per version, as part of the pull request that bumps the pins — so
merging that note is the decision to release, and everything after it was
mechanical: cut a tag whose name has to match the note's filename exactly, and
push it.

auto-release.yml does that. On a push to the default branch touching
docs/release-notes/**, it takes the notes the push ADDED (not modified —
editing an old note is a correction, not a release), derives each tag from the
filename, and tags the merge commit. Two filename conventions, matching what
each repository already does: bare version here, so 2.34.1.4.md tags v2.34.1.4.

It then dispatches release.yml at the new tag rather than relying on the tag
push to trigger it. That is not a stylistic choice: a tag pushed with
GITHUB_TOKEN deliberately does not fire `on: push: tags`, so release.yml would
never start. workflow_dispatch is documented as an exception that always
creates a run, so release.yml gains a workflow_dispatch trigger; dispatched at
the tag's ref, github.ref_name is the tag and every version, track, notes and
changelog lookup in there behaves exactly as it does today.

Stricter than the manual path on purpose. release.yml accepts a three-part
version; this accepts only four parts, because every release tag any of these
repositories has carried is four-part while the three-part notes that exist
(2.17.2.md, 8.1.7.md, 8.1.2.md) are series overviews. Replayed over every
commit that ever added a note: 77 resolve to the tag that actually exists,
and the only rejections are those three overviews. Re-running is a no-op —
a tag that already exists is skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dd-sdk-ios builds its prebuilt device slices with a 12.0 deployment target
(simulator slices get 14.0), below which Swift withholds static Objective-C
registration for 41 @objc classes - no _OBJC_CLASS_$_<Name> symbol, no
__objc_classlist entry. Every consumer's ios-arm64 link failed on the static
registrar's references while simulator builds worked, in every prebuilt
upstream archive checked (2.30.2, 3.13.0, 3.14.0 and the arm64e twins). The
class objects are present and exported under their Swift metadata names, so
each affected package now carries two generated repairs, both verified on a
physical iPhone:

- <Framework>.aliases: one -Wl,-alias,<swift metadata symbol>,_OBJC_CLASS_$_
  flag per class, folded into the NativeReference LinkerFlags, resolving the
  registrar's references against the exported class object.
- <Framework>Realize.xcframework: a static library whose dyld initializer
  realizes each aliased class via its metadata accessor before main() - the
  registrar's xamarin_create_classes messages every mapped class from main
  before any managed code runs, and a cold message to unrealized metadata is
  a segfault, so nothing later (a module initializer included) is early
  enough.

build/GenerateDeviceClassAliases.sh derives both from the binaries and is
wired into the native-bump ritual; SymbolAuditTests holds the bound API, the
shipped binaries and the shipped repairs together at pack time - the check
whose absence let this ship broken; the release link check becomes a
net9/net10 matrix and the example gains a net10 band to feed it. 3.14.0.5
release notes flag every earlier package as device-link-broken; the defect is
reported upstream with the evidence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@sbokatuk
sbokatuk merged commit cac568f into main Jul 28, 2026
8 checks passed
@sbokatuk
sbokatuk deleted the ci/align-release-gate branch July 28, 2026 20:34
Copilot stopped work on behalf of sbokatuk due to an error July 28, 2026 20:57

This branch was previously deployed

1 inactive deployment
nuget.org — 1c30c8e6 Deployed Jul 28, 2026 by Copilot via publish beta to nuget.org #19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants