Skip to content

fix(gha): pass -R to gh pr edit in release_github relabel step - #372

Merged
so0k merged 1 commit into
mainfrom
fix/release-github-safe-directory
Aug 7, 2026
Merged

fix(gha): pass -R to gh pr edit in release_github relabel step#372
so0k merged 1 commit into
mainfrom
fix/release-github-safe-directory

Conversation

@so0k

@so0k so0k commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Summary

  • The release_github job's "Mark merged release PR as tagged" step calls gh pr edit without an explicit repo, so gh shells out to git to auto-detect it.
  • That job runs inside the jsii-terraform container, where the checkout is owned by a different UID than the container user, so git refuses with "detected dubious ownership" and the step fails (exit code 1), even though the GitHub release itself already succeeded.
  • Fix: pass -R "${{ github.repository }}" to gh pr edit so it never needs git to infer the repo — smallest possible fix, no container/git config changes needed.

Note: an alternative fix would be adding a git config --global --add safe.directory /__w/cdk-terrain/cdk-terrain step after checkout (as prepare-release and prepare-next already do), but passing -R avoids touching git config in the container entirely.

Diagnosed from the failed run: https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482

As an immediate unblock, I've also manually relabeled the affected PR (#303) from autorelease: pending to autorelease: tagged so release-please can open the next release PR.

Test plan

  • Next release run exercises the release_github job's relabel step and confirms gh pr edit -R ... succeeds inside the container

gh pr edit was shelling out to git to auto-detect the repo, and git
refused inside the release_github container ("dubious ownership"),
breaking the autorelease-tagged relabel and blocking the next
release-please PR.
@so0k
so0k requested a review from a team as a code owner August 7, 2026 01:41
@so0k so0k added ci/skip-examples Skip Examples Testing in PR ci/skip-integration Skips Integration Testing on PR ci/skip-provider-integration Skips Provider Integration Tests on PR ci/skip-unit Skips Unit Testing on PR labels Aug 7, 2026
@so0k
so0k merged commit 358edc7 into main Aug 7, 2026
113 of 274 checks passed
@so0k
so0k deleted the fix/release-github-safe-directory branch August 7, 2026 03:23
X-Guardian pushed a commit to X-Guardian/cdk-terrain that referenced this pull request Aug 10, 2026
…constructs#372)

## Summary
- The `release_github` job's "Mark merged release PR as tagged" step
calls `gh pr edit` without an explicit repo, so `gh` shells out to `git`
to auto-detect it.
- That job runs inside the `jsii-terraform` container, where the
checkout is owned by a different UID than the container user, so `git`
refuses with "detected dubious ownership" and the step fails (exit code
1), even though the GitHub release itself already succeeded.
- Fix: pass `-R "${{ github.repository }}"` to `gh pr edit` so it never
needs `git` to infer the repo — smallest possible fix, no container/git
config changes needed.

Note: an alternative fix would be adding a `git config --global --add
safe.directory /__w/cdk-terrain/cdk-terrain` step after checkout (as
`prepare-release` and `prepare-next` already do), but passing `-R`
avoids touching git config in the container entirely.

Diagnosed from the failed run:
https://github.com/open-constructs/cdk-terrain/actions/runs/31133236561/job/92730605482

As an immediate unblock, I've also manually relabeled the affected PR
(open-constructs#303) from `autorelease: pending` to `autorelease: tagged` so
release-please can open the next release PR.

## Test plan
- [ ] Next release run exercises the `release_github` job's relabel step
and confirms `gh pr edit -R ...` succeeds inside the container
@github-actions

github-actions Bot commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

I'm going to lock this pull request because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Sep 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

ci/skip-examples Skip Examples Testing in PR ci/skip-integration Skips Integration Testing on PR ci/skip-provider-integration Skips Provider Integration Tests on PR ci/skip-unit Skips Unit Testing on PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants