ci: allow release tags from development OR main #140

Merged

mik-tf merged 1 commit from development_mik_release_branch_gate into development

2026-05-04 23:12:54 +00:00

mik-tf commented

2026-05-04 23:06:01 +00:00

Owner

The previous Verify tag is on release branch step required the tag commit to be an ancestor of origin/main. Hero convention is that development is the trunk — most feature work lands there directly and tags are pushed from development. main is reserved for periodic release cuts.

This is the second of two prerequisites for ever publishing a hero_whiteboard release: PR #139 fixed artifact naming (home#212), this PR fixes the ancestry gate so a development-branch tag can pass it. The third prerequisite (FORGEJO_TOKEN write:repository scope) was rotated out-of-band before this session.

Workspace pre-merge gate already green from PR #139 (no .rs files touched here).

Signed-off-by: mik-tf

Mirrors the canonical Hero release-workflow pattern from https://forge.ourworld.tf/lhumina_code/hero_proxy/src/branch/development/.forgejo/workflows/release.yaml#L36-L45, propagated to hero_aibroker via https://forge.ourworld.tf/lhumina_code/hero_aibroker/pulls/57. The previous Verify tag is on release branch step required the tag commit to be an ancestor of origin/main. Hero convention is that development is the trunk — most feature work lands there directly and tags are pushed from development. main is reserved for periodic release cuts. This is the second of two prerequisites for ever publishing a hero_whiteboard release: PR #139 fixed artifact naming (home#212), this PR fixes the ancestry gate so a development-branch tag can pass it. The third prerequisite (FORGEJO_TOKEN write:repository scope) was rotated out-of-band before this session. Workspace pre-merge gate already green from PR #139 (no .rs files touched here). Signed-off-by: mik-tf

mik-tf added 1 commit

2026-05-04 23:06:01 +00:00

ci: allow release tags from development OR main

CI / build (pull_request) Successful in 2m29s

Details

c25ffc4cf4

Mirrors the canonical Hero release-workflow pattern from
https://forge.ourworld.tf/lhumina_code/hero_proxy/src/branch/development/.forgejo/workflows/release.yaml#L36-L45,
propagated to hero_aibroker via
lhumina_code/hero_aibroker#57.

The previous "Verify tag is on release branch" step required the tag
commit to be an ancestor of `origin/main`. Hero convention is that
`development` is the trunk — most feature work lands there directly
and tags are pushed from `development`. `main` is reserved for
periodic release cuts and does not always include the latest dev
HEAD.

Symptom of the previous bug: v0.1.0 was tagged from a development
commit not on `main` (after PR #128 merged from development → main,
development continued past that point). The post-tag workflow ran
the build successfully, then the release-create POST failed with
HTTP 403 due to a separate FORGEJO_TOKEN scope issue. With the token
scope now corrected, the next tag would still have failed at this
ancestry guard before reaching release-creation.

Switches `git merge-base --is-ancestor "$TAG_COMMIT" FETCH_HEAD`
(single-branch ancestry) to
`git branch -r --contains "$TAG_COMMIT" | grep -qE 'origin/(development|main)'`
(multi-branch reachability), and fetches both refs into the shallow
clone before checking.

Signed-off-by: mik-tf