`release.yml` publishes artifacts without requiring quality gates to pass first #10693

New issue

Open

opened 2026-04-19 06:35:35 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-19 06:35:35 +00:00

Owner

Issue Description

The .forgejo/workflows/release.yml workflow builds and publishes release artifacts (Python wheel, Docker images, Forgejo release) without requiring any quality gates to pass first. A release could be published from broken, untested, or insecure code.

Current Behavior

release.yml triggers on push of v* tags and runs build-wheel, build-docker, and create-release — none of which require lint, typecheck, security scan, unit tests, integration tests, or coverage to pass.

Risk

A release tag pushed directly (bypassing CI) publishes untested artifacts
A release could contain failing tests, type errors, or security vulnerabilities
The 97% coverage requirement is not enforced at release time

Expected Behavior

Add a quality-gate job that runs nox -s lint typecheck security_scan unit_tests coverage_report as a prerequisite for build-wheel.

Subtasks

Add quality-gate job to release.yml that runs lint, typecheck, security_scan, unit_tests, coverage_report
Update build-wheel to needs: [quality-gate]
Verify release workflow still completes successfully when all gates pass
Document the quality gate requirement in release workflow comments

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged.

Metadata

Commit Message: fix(ci): add quality gate prerequisite to release.yml before artifact publication
Branch Name: fix/ci-release-quality-gate

Duplicate Check

Searched open and closed issues for: "release quality gate", "release workflow test", "release.yml CI". No existing issues found.

Automated by CleverAgents Bot
Supervisor: Implementation Pool | Agent: implementation-worker

## Issue Description The `.forgejo/workflows/release.yml` workflow builds and publishes release artifacts (Python wheel, Docker images, Forgejo release) without requiring **any quality gates** to pass first. A release could be published from broken, untested, or insecure code. ## Current Behavior `release.yml` triggers on `push` of `v*` tags and runs `build-wheel`, `build-docker`, and `create-release` — none of which require lint, typecheck, security scan, unit tests, integration tests, or coverage to pass. ## Risk - A release tag pushed directly (bypassing CI) publishes untested artifacts - A release could contain failing tests, type errors, or security vulnerabilities - The 97% coverage requirement is not enforced at release time ## Expected Behavior Add a `quality-gate` job that runs `nox -s lint typecheck security_scan unit_tests coverage_report` as a prerequisite for `build-wheel`. ## Subtasks - [ ] Add `quality-gate` job to `release.yml` that runs lint, typecheck, security_scan, unit_tests, coverage_report - [ ] Update `build-wheel` to `needs: [quality-gate]` - [ ] Verify release workflow still completes successfully when all gates pass - [ ] Document the quality gate requirement in release workflow comments ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged**. ## Metadata - **Commit Message**: `fix(ci): add quality gate prerequisite to release.yml before artifact publication` - **Branch Name**: `fix/ci-release-quality-gate` ## Duplicate Check Searched open and closed issues for: "release quality gate", "release workflow test", "release.yml CI". No existing issues found. --- **Automated by CleverAgents Bot** Supervisor: Implementation Pool | Agent: implementation-worker

HAL9000 added this to the v3.2.0 milestone

2026-04-19 06:35:35 +00:00

HAL9000 self-assigned this

2026-04-19 06:35:35 +00:00

HAL9000 added the