Skip to content

ci: restore annotated tags so Guix tag builds use the tag's version - #7997

Closed
PastaPastaPasta wants to merge 1 commit into
dashpay:developfrom
PastaPastaPasta:fix/guix-tag-describe
Closed

ci: restore annotated tags so Guix tag builds use the tag's version#7997
PastaPastaPasta wants to merge 1 commit into
dashpay:developfrom
PastaPastaPasta:fix/guix-tag-describe

Conversation

@PastaPastaPasta

@PastaPastaPasta PastaPastaPasta commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Issue being fixed or feature implemented

The Guix CI build for the v23.1.10 tag (run 41110158089) was named 23.1.9-15-g703b2a08de17 instead of 23.1.10, so none of its archive hashes matched the release attestations in guix.sigs. Only win64-setup-unsigned.exe matched.

The checkout log shows why. On a tag push, actions/checkout v4 first fetches every tag. It then fetches the triggering tag again as +703b2a08…:refs/tags/v23.1.10, which replaces the signed annotated tag with a lightweight one on the same commit. git describe (used by git_head_version in contrib/guix/libexec/prelude.bash) skips lightweight tags, so it fell back to v23.1.9.

actions/checkout v6, which develop and v24.0.x use, no longer rewrites the tag. v23.1.x still pins v4, so its tag builds are versioned wrongly.

What was done?

In the build job of guix-build.yml:

  • Restore annotated tags (on tag pushes): runs git fetch --force --tags origin after checkout, so the real annotated tag replaces the lightweight one, whichever checkout version is pinned.
  • Verify build version matches tag (on v* tag pushes): fails the job with an error if git_head_version (the version Guix will build) is not exactly the pushed tag. A wrong version would then fail the build instead of producing artifacts that can't match guix.sigs.

On develop this is a guard against checkout regressions. On v23.1.x it is the actual fix. Please backport to v23.1.x, where checkout v4 makes it needed.

How Has This Been Tested?

  • Locally, replayed the exact git commands from the run's checkout log against a clone holding the signed v23.1.10 tag. After checkout the tag was a commit (lightweight) and git describe was not v23.1.10. After git fetch --force --tags origin it was a tag again and the new check printed Building version 23.1.10.
  • On GitHub-hosted ubuntu-24.04-arm runners, pushed a throwaway annotated tag to a fork, with a workflow running these same steps after actions/checkout v4 and v6 (same path/fetch-depth: 0/persist-credentials: false inputs):
    • v4: before the fix type=commit describe=v23.1.8-2706-g79281092d3c5. After the fix type=tag describe=v99.0.0-tagtest.1, and the check passed.
    • v6: the tag was already annotated. The restore step was a no-op and the check passed.
  • zizmor (test/lint/lint-github-actions.py config) reports no findings.

Breaking Changes

None. A tag build now fails early if its version doesn't match the tag.

Checklist:

  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation
  • I have assigned this pull request to a milestone (if you have permission to set one)

🤖 Generated with Claude Code

@PastaPastaPasta @claude
ci: restore annotated tags so Guix tag builds use the tag's version
a16057f 
On tag pushes actions/checkout@v4 fetches the triggering tag again as
`+<commit>:refs/tags/<tag>`, which replaces the annotated tag with a
lightweight one. `git describe` ignores lightweight tags, so the v23.1.10
Guix build (v23.1.x still pins checkout@v4) was named
23.1.9-15-g703b2a08de17 and none of its archive hashes matched the
release attestations. checkout@v6 no longer rewrites the tag.

Re-fetch the tags with --force after checkout to restore the annotated
tag whatever the checkout version does, and fail the build if the
version Guix would use differs from a v* tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PastaPastaPasta PastaPastaPasta added this to the 24 milestone Oct 31, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 31, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-10-31T03:56:52.951002Z
We couldn’t complete this review. Comment @codex review to try again.		 a16057f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 31, 2026

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 76c3eb83-2eb0-471f-b4d4-10191ec5ba71
Commits

Reviewing files that changed from the base of the PR and between 4326d22 and a16057f.

Files selected for processing: 1
  • .github/workflows/guix-build.yml
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 31, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@thepastaclaw

thepastaclaw commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

✅ Final review complete — no blockers (commit a16057f) · triage: low

@PastaPastaPasta PastaPastaPasta mentioned this pull request Oct 31, 2026
Merged
3 tasks done
thepastaclaw
thepastaclaw approved these changes Oct 31, 2026
View reviewed changes

@thepastaclaw thepastaclaw left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final validation — Phase 1 + Phase 2

The tag restoration runs in the correct checkout before version selection, and the version guard checks the same helper Guix uses; no actionable defects were found. The ShellCheck nitpick is a false positive because the parameterless function is correctly invoked without arguments. Validation was static only: current lint and formatting checks pass, source-build jobs remain pending, and Guix jobs were skipped, so this PR's CI does not independently exercise the tag-push path; the earlier PR-title policy failure has been superseded by a passing check.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

  • Triage: low by gpt-6.1-sol (effort low) — The change adds two small, well-contained CI steps to restore annotated tags and verify the build version, with straightforward behavior and no critical-surface changes.
  • Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer
  • Phase 1 model: glm-5.3-flash — zai quota: 5h 97% left, weekly 78% left; passed over gemini-3.8-flash-high (antigravity quota lookup failed)
  • Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
  • Phase 2 reviewers: gpt-6.1-sol — general (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — dash-core-commit-history (completed, effort medium); agent phase2-reviewer

@thepastaclaw thepastaclaw added the pastaclaw:approved thepastaclaw's latest review approved this PR label Oct 31, 2026
@PastaPastaPasta

PastaPastaPasta commented Oct 31, 2026

Copy link
Copy Markdown
Member Author

Closing this. The tag rewrite only happens with actions/checkout v4, so the cleaner fix would be moving v23.1.x to checkout v6, and that isn't worth doing for this alone. develop and v24.0.x already use v6. #7998 will be reworked to stand alone on develop.

🤖 Posted autonomously by Claude on behalf of pasta.

@thepastaclaw thepastaclaw removed the pastaclaw:approved thepastaclaw's latest review approved this PR label Oct 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@UdjinM6 UdjinM6 Awaiting requested review from UdjinM6 UdjinM6 is a code owner
@knst knst Awaiting requested review from knst knst is a code owner
1 more reviewer
@thepastaclaw thepastaclaw thepastaclaw approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

24

Development

Successfully merging this pull request may close these issues.

2 participants

@PastaPastaPasta @thepastaclaw