Repository navigation
SK-2967 restore the [AUTOMATED] loop guard to stop the release recursion #439
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish module to the JFROG Artifactory | |
| on: | |
| push: | |
| # '**' not '*.*': GitHub Actions glob '*' does not match '/', so the old | |
| # '*.*' pattern failed to ignore slash-containing tags like | |
| # 'flowvault/v1.0.0' - a public release tag would also fire this internal | |
| # workflow (and, since the ref isn't a flowvault-release/* branch, | |
| # resolve-module fell through to skyvault, publishing the wrong module). | |
| # '**' matches every tag, so this stays strictly branch-triggered. | |
| tags-ignore: | |
| - '**' | |
| paths-ignore: | |
| - "*.md" | |
| branches: | |
| - flowvault-release/* | |
| - skyvault-release/* | |
| # Legacy: predates the per-module naming, still maps to skyvault. | |
| - release/* | |
| jobs: | |
| resolve-module: | |
| runs-on: ubuntu-latest | |
| # Skip this workflow's own version-bump commit, or the release loops: | |
| # bump -> push -> release -> bump -> ... | |
| # | |
| # The bump is force-pushed using PAT_ACTIONS, and PAT-authenticated pushes | |
| # DO trigger workflows - GITHUB_TOKEN pushes deliberately do not. So this | |
| # guard only becomes load-bearing once the PAT is wired up correctly, which | |
| # is why the loop appeared the moment that was fixed. It existed on the v3 | |
| # branch and was lost in the modularization; without it the workflow | |
| # re-fires roughly every 30 seconds indefinitely. | |
| # | |
| # build-and-deploy needs this job, so skipping here skips the whole run. | |
| if: ${{ !contains(github.event.head_commit.message, '[AUTOMATED]') }} | |
| outputs: | |
| module: ${{ steps.set-module.outputs.module }} | |
| steps: | |
| # Matched explicitly rather than with an if/else that defaults to one | |
| # module. A catch-all else is how a flowvault tag previously ended up | |
| # publishing skyvault: anything unrecognised silently became skyvault. | |
| # An unmatched branch now fails instead of guessing. | |
| - name: Resolve module from branch name | |
| id: set-module | |
| env: | |
| BRANCH: ${{ github.ref_name }} | |
| run: | | |
| case "$BRANCH" in | |
| flowvault-release/*) MODULE="flowvault" ;; | |
| skyvault-release/*) MODULE="skyvault" ;; | |
| release/*) MODULE="skyvault" ;; | |
| *) | |
| echo "::error::Branch '$BRANCH' does not map to a module." | |
| exit 1 | |
| ;; | |
| esac | |
| echo "Branch '$BRANCH' -> module '$MODULE'" | |
| echo "module=$MODULE" >> "$GITHUB_OUTPUT" | |
| build-and-deploy: | |
| needs: resolve-module | |
| uses: ./.github/workflows/shared-build-and-deploy.yml | |
| with: | |
| ref: ${{ github.ref_name }} | |
| server-id: central | |
| profile: jfrog | |
| tag: 'internal' | |
| module: ${{ needs.resolve-module.outputs.module }} | |
| secrets: | |
| server-username: ${{ secrets.ARTIFACTORY_USERNAME }} | |
| server-password: ${{ secrets.ARTIFACTORY_PASSWORD }} | |
| gpg-key: ${{ secrets.JFROG_GPG_KEY }} | |
| gpg-passphrase: ${{ secrets.JFROG_GPG_PASSPHRASE }} | |
| skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} | |
| test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} | |
| test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} | |
| pat-actions: ${{ secrets.PAT_ACTIONS }} | |
| test-credentials-file-string: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }} |