feat: a CI mode for the gate, and a gate report publishing can rely on

--ci records an upgrade no room could take (master between releases, its VERSION already on canary) as SKIP instead of failing every commit; its report can never stand in for a release's. --still-current accepts a report only for these exact bytes, passed, from exactly what canary and stable serve now. update_canary.sh takes one through RELEASE_GATE_REPORT_PASSED, so Preview's publish job needs the key and not Docker. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-29 18:47:42 -05:00
parent 0f96019714
commit 583f9b1809
2 changed files with 83 additions and 4 deletions
@@ -75,7 +75,16 @@ fi
 # to fail here, not on a Sunday. See tools/release-gate.sh.
 hash="$(sha256sum "$package_path" | awk '{print $1}')"

-"$ROOT/tools/release-gate.sh" "$package_path" ${RELEASE_GATE_FROM:-}
+# RELEASE_GATE_REPORT_PASSED=REPORT relies on a gate already run on this
+# file instead — Preview's gate job, which has Docker, where the publish
+# job has the key and no Docker. The report is only accepted if it is a
+# pass for exactly these bytes, from exactly what canary and stable serve
+# now; anything else and nothing is published.
+if [[ -n "${RELEASE_GATE_REPORT_PASSED:-}" ]]; then
+    "$ROOT/tools/release-gate.sh" --still-current "$RELEASE_GATE_REPORT_PASSED" "$package_path"
+else
+    "$ROOT/tools/release-gate.sh" "$package_path" ${RELEASE_GATE_FROM:-}
+fi

 # Checked again after the gate, which takes long enough for somebody else
 # to have published in the meantime — or for the file to have changed.