mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 04:54:52 +09:00
Myasnikov DaniilandClaude Opus 4.8
9a2afa83a1
Replace the force-retag operations in the release flow with write-once / compare-before-force guards, so published tags are never moved (the cache poisoning on api/apps/v1alpha1 via the Go module proxy, plus SBOM/scanner drift, all stem from moved tags). - tags.yaml: the api/apps/v1alpha1 submodule tag is now write-once (create if absent, no-op if unchanged, fail loudly if it would move). The release-X.Y.Z staging branch uses a compare-before-force guard (skip when unchanged; force+log only when the staging branch genuinely moves — it is a mutable staging ref, not an artifact). The build is now skipped when a release (draft OR published) already exists, so a stable tag prepared by promotion is never rebuilt here. - pull-requests-release.yaml: the stable tag is created at the PR merge commit with a write-once guard instead of `git tag -f`/`git push -f` — the merge commit did not exist before the PR opened, so force is impossible by construction. The maintenance branch is fast-forward-only (no `updateRef force:true`); a non-FF update warns and is left for a maintainer. - auto-release.yaml: removed. Stable patch tags were auto-bumped nightly via delete-recreate; stable now appears only through an explicit rc promotion. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>