From 745f64d9bf9aabb2de4d9104339819c76ac4aaa4 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 9 Sep 2026 12:59:46 +0000 Subject: [PATCH] ci: never let the dependency-submission step withhold the GitHub assets The release pipeline is deliberately built so the GitHub assets land even when the Central publish fails: github-snapshot / github-release run on `publish-*.result == 'success' || == 'failure'`, with a comment saying so -- a Central publish-poll timeout must not lose the pre-release assets. That guarantee has a hole upstream of it. The dependency-submission step sits in the `report` job unguarded, and `report` gates the whole chain: report FAILS -> check-snapshot SKIPPED (failed need; its if: is a plain event/ref condition, no always()) -> publish-snapshot SKIPPED (if: check-snapshot.result == 'success') -> github-snapshot does NOT run -- its if: tolerates 'failure' but 'skipped' matches neither arm So a third-party informational action having a bad day does not merely delay a Central publish: it silently defeats the one thing the pipeline goes out of its way to guarantee. The action submits the dependency graph to GitHub; it says nothing about whether the artifacts are correct, so it has no business gating anything. srcmorph already had this guard -- added in passing by ee2ae49 ("report unsigned assets without ever withholding them"), a commit whose *feature* was ported here as a single clean change that reproduced the feature and not the drive-by line. The three repos are now textually identical to srcmorph at that step (same comment, same flag; the 5-line block hashes equal in all four). Note what stays bare, on purpose: checkout and setup-java are infrastructure, and streambuffer's PIT steps are gates, not reports. The convention this restores is narrower -- informational third-party steps do not block -- and the submission action was the only step in `report` violating it, sitting between a guarded download-artifact above and guarded Coveralls/Codecov below. Verified: the four publish.yml files still parse, `report` still has exactly one submission step, and it now carries continue-on-error in all four. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH --- .github/workflows/publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f1d4e099..084f4c9a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3356,7 +3356,11 @@ jobs: - uses: actions/download-artifact@v8 with: { name: jacoco-report, path: target/site/jacoco/ } continue-on-error: true + # Submits the dependency graph to GitHub. Informational: it says nothing about whether the + # artifacts are correct, but it sits in the `report` job, which the release path needs -- so + # without this flag a third-party action having a bad day can block a publish. - uses: advanced-security/maven-dependency-submission-action@v6 + continue-on-error: true - name: Coveralls uses: coverallsapp/github-action@v2 with: