From f5bb24b45c5bab0bb9ae360497446d27c2cf68b8 Mon Sep 17 00:00:00 2001 From: Ritwik G Date: Thu, 25 Jun 2026 18:47:18 +0530 Subject: [PATCH 1/2] [MISC] Reject no-op OSS releases when there are no new commits create-release.yaml computed and published a new tag even when the branch had no commits beyond the last release, producing empty releases (e.g. v0.177.1 points at the exact same commit as v0.177.0). Add a guard after "Fetch base release version": use the compare API's ahead_by (the workflow has no local checkout) to count commits on the branch beyond the latest release tag. If zero, abort with a clear error (dry-run only warns). Works for main and hotfix branches alike. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/create-release.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml index cf7a178759..a082fdfc33 100644 --- a/.github/workflows/create-release.yaml +++ b/.github/workflows/create-release.yaml @@ -126,6 +126,30 @@ jobs: echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT" echo "Base release: $LATEST_TAG" + - name: Ensure there are new commits to release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + LATEST_TAG: ${{ steps.get-latest.outputs.latest_tag }} + BRANCH: ${{ github.ref_name }} + DRY_RUN: ${{ github.event.inputs.dry_run }} + run: | + # Reject a no-op release: if the branch has no commits beyond the last release + # tag (e.g. main is already at v0.177.0), there is nothing to release. This + # prevents empty releases such as v0.177.1 pointing at the same commit as + # v0.177.0. The workflow has no local checkout, so use the compare API's + # `ahead_by` (commits on BRANCH not in LATEST_TAG). + AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by') + if [[ "$AHEAD" -eq 0 ]]; then + if [[ "$DRY_RUN" == "true" ]]; then + echo "::warning::No new commits on '$BRANCH' since $LATEST_TAG — a real run would be rejected (nothing to release)." + else + echo "::error::No new commits on '$BRANCH' since $LATEST_TAG — nothing to release. Aborting to avoid an empty release." + exit 1 + fi + else + echo "✅ $AHEAD new commit(s) on '$BRANCH' since $LATEST_TAG" + fi + - name: Compute next version id: compute-version env: From c7206bbc17033826bd49fe1890e90617fb7fa611 Mon Sep 17 00:00:00 2001 From: Ritwik G Date: Thu, 25 Jun 2026 19:09:38 +0530 Subject: [PATCH 2/2] [MISC] Harden no-op guard: validate ahead_by, fail loudly on unexpected value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR review (Greptile + internal): `[[ "$AHEAD" -eq 0 ]]` mishandled a non-integer ahead_by — an empty value evaluated true ([[ "" -eq 0 ]]) and would wrongly reject a legitimate release, and a literal "null" aborted with a cryptic "integer expression expected" / unbound-variable error. Use `--jq '.ahead_by // empty'`, fail loudly if the compare API call fails, and require ahead_by to match ^[0-9]+$ (error out otherwise) before a string compare against "0". A transient/auth/shape error now fails the step with a clear message instead of being mistaken for "no new commits". Co-Authored-By: Claude Opus 4.8 --- .github/workflows/create-release.yaml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml index a082fdfc33..f9725ee0f4 100644 --- a/.github/workflows/create-release.yaml +++ b/.github/workflows/create-release.yaml @@ -137,9 +137,17 @@ jobs: # tag (e.g. main is already at v0.177.0), there is nothing to release. This # prevents empty releases such as v0.177.1 pointing at the same commit as # v0.177.0. The workflow has no local checkout, so use the compare API's - # `ahead_by` (commits on BRANCH not in LATEST_TAG). - AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by') - if [[ "$AHEAD" -eq 0 ]]; then + # `ahead_by` (commits on BRANCH not in LATEST_TAG). `// empty` stops a null/ + # absent value from reaching the comparison as the literal "null"; we then + # require a non-negative integer and fail loudly on anything unexpected, so a + # transient API error is never mistaken for "no new commits". + AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by // empty') \ + || { echo "::error::Could not query commits since $LATEST_TAG (compare API failed)."; exit 1; } + if ! [[ "$AHEAD" =~ ^[0-9]+$ ]]; then + echo "::error::Unexpected ahead_by='${AHEAD:-}' from compare ${LATEST_TAG}...${BRANCH}; refusing to guess." + exit 1 + fi + if [[ "$AHEAD" == "0" ]]; then if [[ "$DRY_RUN" == "true" ]]; then echo "::warning::No new commits on '$BRANCH' since $LATEST_TAG — a real run would be rejected (nothing to release)." else