supabase / supavisor / 33402276217
80%

DEFAULT BRANCH: main
Ran
Jobs 2
Files 132
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 78.086% (+0.06%) from 78.03%
33402276217

push

github

web-flow 
ci: publish Docker Hub releases from release tags (#1169)

## Summary
- `Release on Dockerhub` only ran on pushes to `main` when `VERSION`
changed. Version bumps now land on the release line (the `v2.9` branch),
so Hub never got 2.9.8–2.9.11 (2.9.12 was published manually from a side
branch). The old trigger was also a footgun: it path-filtered on the
workflow file itself, so merging any change to it — including the
previous version of this PR — would have rebuilt the stale 2.9.7 from
main's much newer tree and overwritten the published Hub tag, then
mirrored that to ECR/GHCR.
- Replace it with tag-anchored publishing:
- `push` on `v*` tags publishes the tagged version automatically as
releases happen. GitHub reads the workflow from the pushed tag, so this
file must also be cherry-picked to the `v2.9` branch to cover future
tags cut there — merging to main alone is not enough.
- `workflow_dispatch` with a required `version` input backfills tags cut
before the trigger existed. The dispatched ref is only used to locate
the workflow file; the validated input decides what gets built.
- Every run checks out `refs/tags/v<version>` explicitly (the build jobs
previously used the Git context of the triggering ref) and refuses to
publish if the tag's `VERSION` file disagrees with the version being
published.
- Optional `otp_version` / `debian_version` dispatch inputs override the
Dockerfile `ARG`s for old tags whose pinned OTP 27.2.1 can no longer
fetch from builds.hex.pm (`key_usage_mismatch`), so backfills don't need
patched side branches.

## Test plan
- [x] actionlint passes (only pre-existing warning is the custom
`arm-runner` label)
- [x] Version-derivation logic tested locally: tag push, dispatch input
with/without leading `v`, build-arg emission, and rejection of
non-version inputs (`main`, shell metacharacters)
- [ ] Merge this to main, then cherry-pick the same commit to `v2.9` so
future tags auto-publish
- [ ] Backfill the missing releases: `gh workf... (continued)

2790 of 3573 relevant lines covered (78.09%)

52386.37 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
81.63
 -4.08% lib/supavisor/secret_checker.ex
1
78.95
 -5.26% lib/supavisor/monitoring/telem.ex
Jobs
ID Job ID Ran Files Coverage
1 run-integration - 33402276217.1 132
42.01
 GitHub Action Run
2 run-tests - 33402276217.2 132
76.71
 GitHub Action Run
Source Files on build 33402276217