Repository navigation
fix(website): deploy main, not the tag ref - #837
Merged
Merged
Conversation
Two fixes to the release-triggered deploy observed in run 38835604913: 1. The website environment's custom branch policy does not admit tag refs, and the release event's ref IS a tag — the deploy can never pass environment protection. Checkout refs/heads/main instead: the release commit is main's tip by construction (changesets opens the release PR from main), so the deployed build is the released content. 2. Restore job-level concurrency (lost when the workflow landed on main without it): a relay release must fail the job's tag filter before it enters the deploy queue, not after, or it can replace a queued website deploy.
🦋 Changeset detectedLatest commit: bf5d32a The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
 [Critical impact] The workflow change appears safe to merge; the incorrect release note is non-blocking. Findings
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
chappie-daemon
added a commit
that referenced
this pull request
Oct 16, 2026
Greptile P1 on #838: the release-trigger move dropped main's old workflow_dispatch guard, so a manual run from any branch would build the selected ref and wrangler-deploy it to production. Restore the guard: dispatch requires github.ref == refs/heads/main; release runs are unaffected (their ref is the website tag, admitted by the tag_name check). Coordinated with #837, which pins the release checkout to refs/heads/main for the environment's branch policy.
Ferryx349
approved these changes
Oct 16, 2026
The environment's branch policy admits nostream-website@* (every release deploy since 1.1.1 has run on the tag ref), so the refs/heads/main pin was never needed for admission — and it was wrong for correctness: main can advance between the release publish and the job starting, and the pin would build and deploy unreleased content. Keep the default tag checkout so the deployed build is exactly the released commit. Also restore the router-worker deploy line the branch predates.
Resolve the workflow conflict in favor of both changes: job-level concurrency (the relay-release cancellation is measured — run 38845857055 died with zero jobs at the workflow-level group) and main's tag-checkout + router deploy.
The changeset still claimed releases deploy main because the environment rejects tag refs; the fix actually keeps the triggering tag (which the policy admits) and the real change is the job-scoped deploy queue. Rewritten before it becomes release notes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failure in run 38835604913 — "Tag nostream-website@1.1.1 is not allowed to deploy to website due to environment protection rules".
Cause: the
websiteenvironment uses a custom branch policy, and GitHub's deployment protection only matches branch names — a tag ref (refs/tags/nostream-website@1.1.1, which is what arelease: publishedtrigger carries) can never pass it. Every website release would fail the same way.Fix 1 — deploy main: the checkout pins
refs/heads/main. The release commit is main's tip by construction (changesets opens the release PR from main and merging it publishes the release), so the deployed build is exactly the released content.Fix 2 — job-level concurrency restored: main's copy of the workflow carries the concurrency block at workflow level (it landed without the round-1 review fix from #834). At workflow level a relay release (
v*tag) enters the deploy queue before the job's tag filter rejects it, and as a queued entry it can replace a pending website deploy. Moved back into the job with its rationale comment.To deploy nostream-website@1.1.1 after merge: re-run 38835604913 (or trigger workflow_dispatch on main).