mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov Daniil
c6ffb1be63
The finalize job's registry steps (retag rc images to stable, publish the stable cozy-installer chart) run on the promote-PR merge commit, so a re-run after a mid-flight failure reuses the same tree — a script fix landed on main can never reach it. v1.6.0 hit exactly this: 32 of 43 repos were left untagged and the chart unpublished, recovered by hand with 64 skopeo copies plus helm package/push from the tag tree. Add redo-registry-finalize.yaml, a workflow_dispatch(tag) lane that repeats the registry part for an existing stable tag with a dual checkout: scripts come from the dispatch-time main ref, the release tree (digest pins, chart sources) from refs/tags/<tag>. Guards: strict stable-tag validation, dispatch-from-main check, published-release check, and the same max-published-stable decision as finalize so replaying an old release can repair its immutable tags but never steal :latest. Images stay write-once via promote-retag.sh; the chart step is verify-or-fail — an already-published chart is pulled and compared by extracted file contents, a mismatch fails red before any :latest move unless force_chart=true consciously republishes. Auth is the built-in GITHUB_TOKEN with packages: write only; the lane pushes no git refs. Assisted-By: GPT-5 <noreply@openai.com> Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>