fix(template): set environment 'nuget' + concurrency on canonical nuget-publish#27
fix(template): set environment 'nuget' + concurrency on canonical nuget-publish#27ANcpLua wants to merge 1 commit into
Conversation
…et-publish
The nuget.org Trusted Publisher policies for the .NET fleet repos (verified on
Qyl.OpenTelemetry.SemanticConventions, .Autoinstrumentation, ancplua.evaluation.template)
require Environment = 'nuget', but the canonical nuget-publish.yml set no
`environment:` on the publish job. Every release therefore fails OIDC token
exchange with:
Token exchange failed (HTTP 401) ... Environment mismatch for policy '<pkg>':
expected 'nuget', actual ''
Add `environment: nuget` to the publish job so the OIDC environment claim matches
the policy. Also add a `concurrency` group (serialize releases per ref, never
cancel an in-flight publish) so overlapping tag pushes can't race.
Propagated to fleet repos via the next enforce-repo-settings sweep (or the
targeted sync-nuget-publish.sh). Repos that pinned a per-repo CANONICAL-DEPARTURE
for this exact reason can drop it once synced.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note
|
| Layer / File(s) | Summary |
|---|---|
Ref-scoped concurrency templates/nuget-publish.yml |
The workflow groups publish runs by github.ref and keeps in-progress runs from being canceled within the same ref group. |
Publish job environment templates/nuget-publish.yml |
The publish job uses the nuget environment and documents that it must match the nuget.org Trusted Publisher Environment value for OIDC token exchange. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
🚥 Pre-merge checks | ✅ 7
✅ Passed checks (7 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title accurately summarizes the concrete workflow changes: nuget environment and per-ref concurrency. |
| Description check | ✅ Passed | The description directly explains the same nuget publish environment and concurrency updates in the workflow. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| No Retired Reviewers | ✅ Passed | The only changed workflow is templates/nuget-publish.yml, and it adds NuGet publish concurrency/environment settings with no Codacy, triage-bot, or reviewer-bot automation. |
| Automation Is Event Scoped | ✅ Passed | The PR only updates the NuGet publish workflow to run on tag push/manual dispatch; it adds no schedule or reviewer/repair polling automation. |
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
fix/nuget-publish-template-environment
✨ Simplify code
- Create PR with simplified code
- Commit simplified code in branch
fix/nuget-publish-template-environment
- 🛠️ repair automation
- 🛠️ cleanup stale review automation
Comment @coderabbitai help to get the list of available commands.
|
Closing — this blanket Investigation of actual release history shows the fleet is split but internally consistent:
So a single hardcoded If the fleet wants to standardize, the robust template change is |
1 participant
Why
The nuget.org Trusted Publisher policies for the .NET fleet repos require Environment =
nuget(verified onQyl.OpenTelemetry.SemanticConventions,.Autoinstrumentation,ancplua.evaluation.template), but the canonicalnuget-publish.ymlset noenvironment:on the publish job. So every fleet release fails OIDC token exchange:(This already bit the
Qyl.OpenTelemetry.SemanticConventionsv3.1.0 release, which is currently carrying a per-repoCANONICAL-DEPARTUREworkaround.)Fix
environment: nugetto the publish job → OIDC environment claim matches the policy.concurrencygroup (serialize per ref,cancel-in-progress: false) so overlapping tag pushes can't race a publish (also addresses a CodeRabbit note).Rollout
Propagates to fleet repos on the next
enforce-repo-settingssweep (or targetedsync-nuget-publish.sh). Repos carrying a per-repo departure marker for this exact reason can drop it once synced.🤖 Generated with Claude Code