mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov Daniil
64ec30b1ef
promote-publish-chart.sh stamps platformVersion into packages/core/installer/values.yaml in place and never put it back. On an ephemeral runner that is harmless, but the manual recovery path in docs/release.md runs the script in an operator's own checkout, where it left a modified tracked file that the next commit could pick up and leak onto the release line. The file is now restored from the EXIT trap, so a failing run puts it back as well as a successful one. The publish job runs these scripts from main while holding packages: write on the release registry, which widens what has to be trusted to write stable tags beyond the reviewed release tree. The comment on the checkout now says so next to the correctness cost it already named. The header of the script also records that the already-published probe fails closed on registry answers it does not recognise, so a first-ever push of a new chart repository that GHCR answers with denied or unauthorized aborts and needs one manual helm push. Assisted-by: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>