ci(corpus): fix release publishing (GH_REPO) + publish-only recovery path - #336
Merged
Conversation
…path The corpus/otel-demo-v7 publish failed after its 5-hour capture succeeded: `gh release create` → "fatal: not a git repository". The publish job has no checkout (deliberate — #251 split it off so the write token never coexists with the third-party demo images), so `gh` cannot resolve the repository from a git remote. v6 predates that split (2026-06-10 vs #251 on 2026-06-19); v7 was the first publish attempt since, hitting the latent gap. Fix: set `GH_REPO: ${{ github.repository }}` on the publish step. Also add the recovery path so the successful capture is not wasted: a new `artifact_run_id` dispatch input skips the capture job and publishes from the `otel-demo-corpus` artifact of the named earlier run (cross-run download-artifact with the token; retained until 2026-09-30 for v7's run). The release notes now record the capture run id, and the input docs require passing the original capture's parameters so the notes stay truthful. Verified: YAML parses; actionlint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdds an ChangesWorkflow recovery/publish path
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant Workflow as GitHub Actions Workflow
participant GhApi as GitHub Actions API
participant Release as GitHub Release
User->>Workflow: dispatch with artifact_run_id set
Workflow->>Workflow: skip capture job
Workflow->>Workflow: download otel-demo-corpus artifact from artifact_run_id
Workflow->>GhApi: query head SHA of captured run
GhApi-->>Workflow: capture_sha
Workflow->>Release: publish release with notes referencing capture_sha
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes GitHub release publishing for the capture-otel-demo-corpus workflow’s split publish job (which intentionally has no checkout) by explicitly setting GH_REPO, and adds a publish-only recovery path that can re-mint a release from an earlier successful capture artifact via a workflow-dispatch artifact_run_id.
Changes:
- Add
artifact_run_idworkflow-dispatch input to support a publish-only recovery path that downloadsotel-demo-corpusfrom a prior run. - Adjust job gating so
publishcan run whencaptureis skipped (recovery), while still requiring a successful capture or explicit recovery input. - Provide
GH_REPOto thegh releasestep and includecapture run idin release notes for better provenance.
Comments suppressed due to low confidence (1)
.github/workflows/capture-otel-demo-corpus.yml:366
actions/download-artifactis now configured for cross-run downloads (run-id+github-token). With explicit job permissions, the token needsactions: readto access artifacts from other runs; otherwise the recovery path can fail with authorization errors.
permissions:
contents: write
# Sigstore-sign the corpus attestation (keyless OIDC) and store it.
attestations: write
id-token: write
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot's review of #336, both accepted: - The artifact_run_id input doc named a non-existent `duration` input; corrected to `duration_seconds`. - On the recovery path, `source commit` recorded the publish dispatch's GITHUB_SHA instead of the commit the capture ran at; the publish step now resolves the capture run's head_sha via the Actions API when CAPTURE_RUN_ID differs from the current run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/workflows/capture-otel-demo-corpus.yml:367
- The publish job now calls the Actions API (
gh api …/actions/runs/...) and can download artifacts from another workflow run (download-artifactwithrun-id). With the current job-levelpermissionsblock, the token may not haveactions: read, causing the recovery path to fail with permission errors (e.g., "Resource not accessible by integration"). Addactions: readto the publish job permissions.
permissions:
contents: write
# Sigstore-sign the corpus attestation (keyless OIDC) and store it.
attestations: write
id-token: write
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/capture-otel-demo-corpus.yml (1)
362-367: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAdd
actions: readto thepublishjob
The recovery path uses cross-rundownload-artifactandgh api .../actions/runs/...; both needactions: read, soartifact_run_iddispatches will 403 until this permission is added.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/capture-otel-demo-corpus.yml around lines 362 - 367, The publish job is missing the Actions read permission needed by its recovery flow. Update the publish job permissions alongside the existing contents/attestations/id-token entries so that the job also has actions: read, which allows the download-artifact and gh api calls in the artifact_run_id dispatch path to succeed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/capture-otel-demo-corpus.yml:
- Around line 362-367: The publish job is missing the Actions read permission
needed by its recovery flow. Update the publish job permissions alongside the
existing contents/attestations/id-token entries so that the job also has
actions: read, which allows the download-artifact and gh api calls in the
artifact_run_id dispatch path to succeed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3f76cd05-45f0-42eb-a217-6df8b0d2c234
📒 Files selected for processing (1)
.github/workflows/capture-otel-demo-corpus.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
corpus/otel-demo-v7run failed after its 5-hour capture succeeded —in the cheap
publishjob:gh release create→fatal: not a git repository.Root cause: the publish job deliberately has no checkout (#251 split it off
so the write-capable token never coexists with the ~20 third-party demo images),
so
ghcannot resolve the repository from a git remote. v6 predates that split(created 2026-06-10; the split landed 2026-06-19) — v7 was the first publish
attempt since the split, hitting the latent gap. Not a #332 regression: the
new attest/bundle steps all succeeded.
Fix:
GH_REPO: ${{ github.repository }}on the publish step.Recovery path (so the 5h capture isn't wasted): a new
artifact_run_iddispatch input skips the capture job and publishes from the
otel-demo-corpusartifact of the named earlier run (cross-run
download-artifactwith thetoken). v7's artifact is retained until 2026-09-30. The publish job's
ifaccepts capture-success or capture-skipped-with-artifact; release notes now
record the capture run id; the input docs require passing the original
capture's parameters so the notes stay truthful.
After merge
Dispatch with
artifact_run_id=28608068720+release_tag=corpus/otel-demo-v7(+ v6's parameters) → the first signed corpus release (attest +
otel-demo-corpus.intoto.jsonlfrom #332), minted from the already-capturedbytes in minutes instead of 5 hours.
Verification
YAML parses;
actionlintclean. The publish path itself is only exercisable bya real dispatch — which the post-merge recovery run performs.
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes