From bb740c221f15b5b64121cf95cfe3aba061b6fd8e Mon Sep 17 00:00:00 2001 From: jakeross Date: Mon, 6 Jul 2026 16:33:46 -0600 Subject: [PATCH] fix(ci): backport CD (Production) deploy-gate fix in hotfix-start MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hotfix branches are cut from release tags via `git checkout -b `, so they inherit whatever CD_production.yml existed at that tag. Tags cut before the deploy-gate fix carry a `production-deploy` gate keyed on `github.event_name == 'workflow_call'` — never true inside a called workflow, which inherits the caller's `push` event — so release-please's inline deploy skips and the hotfix never ships. After creating the branch, surgically rewrite the gate to key on `inputs.tag_name` (empty on the release-event path, so `||` falls through). Surgical sed only, not a whole-file copy from the default branch, whose deploy steps may not match the tag's code (e.g. the renamed refresh-materialized-views CLI, pg_cron, Secret Manager fetch). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/hotfix-start.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/hotfix-start.yml b/.github/workflows/hotfix-start.yml index 4489ce61c..6f1a81e4c 100644 --- a/.github/workflows/hotfix-start.yml +++ b/.github/workflows/hotfix-start.yml @@ -72,6 +72,26 @@ jobs: git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git checkout -b "${{ steps.next.outputs.branch }}" "${{ steps.base.outputs.tag }}" + + # Backport the CD (Production) inline-deploy gate fix. Tags cut before + # the fix carry a gate keyed on `github.event_name == 'workflow_call'`, + # which is NEVER true inside a called workflow (it inherits the + # caller's `push` event), so release-please's inline deploy silently + # skips `production-deploy` and the hotfix never ships. Rewrite the + # gate to key on `inputs.tag_name` (empty on the release path, so `||` + # still falls through). SURGICAL edit only — do not copy the whole + # file from the default branch, whose deploy steps may not match this + # tag's code. + f=.github/workflows/CD_production.yml + if [ -f "$f" ] && grep -qF "github.event_name == 'workflow_call'" "$f"; then + sed -i "s#(github.event_name == 'workflow_call' && inputs.tag_name) || github.event.release.tag_name#inputs.tag_name || github.event.release.tag_name#g" "$f" + git add "$f" + git commit -m "ci: backport CD (Production) inline-deploy gate fix" + echo "Backported CD (Production) deploy-gate fix onto ${{ steps.next.outputs.branch }}." + else + echo "CD (Production) deploy gate already current; no backport needed." + fi + git push origin "${{ steps.next.outputs.branch }}" - name: Summary