fix(release): align trusted qualification CLI contract#10269
Conversation
Remove the stale unsupported --no-promote workflow argument and add a release-flow contract that checks the exact invocation against the qualifier's accepted options. Failure-Class: FC-workflow-script-input-contract Test: python3 .github/scripts/test_desktop_release_flow_contract.py -v Test: actionlint -shellcheck '' .github/workflows/desktop_qualify_beta.yml
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c682b75f34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --github-actions-artifact \ | ||
| --signed-smoke-result /tmp/desktop-beta-qualification/desktop-smoke-result.json \ | ||
| --candidate-gate-result /tmp/desktop-beta-qualification/candidate-gate.json \ |
There was a problem hiding this comment.
With the unsupported --no-promote removed, this invocation can now reach --github-actions-artifact mode, where qualify-desktop-beta.sh exits before its automatic-mode final git fetch/LATEST_TAG recheck. Since the workflow only computes LATEST_TAG before the long T2/fault qualification run and the backend admission path only checks freshness/trusted evidence, a newer v*-macos candidate published while this job is running can still leave this older tag qualified and promoted to Beta. Please repeat the newest-tag gate after the qualification step, before creating evidence or invoking desktop_promote_beta.yml.
Useful? React with 👍 / 👎.
## Summary - remove the stale `--no-promote` requirement from the broad release-process guard - keep every other trusted desktop qualification guard unchanged - restore contract coherence after #10269 removed the unsupported workflow argument Failure-Class: FC-workflow-script-input-contract ## Failure mechanism PR #10269 correctly removed the unsupported `--no-promote` workflow argument, but it was merged while its failing Hygiene run still showed `.github/scripts/check-release-process-guards.py` requiring that fragment. The broad guard therefore rejects the valid parser-supported invocation. ## Verification - `python3 .github/scripts/check-release-process-guards.py` — passed - `backend/.venv/bin/python -m pytest .github/scripts/test_check_release_process_guards.py -q` — 87 passed - `python3 .github/scripts/test_desktop_release_flow_contract.py -v` — 6 passed - `actionlint -shellcheck '' .github/workflows/desktop_qualify_beta.yml` — passed - `make preflight` — 12 selected checks passed - `scripts/failure-class validate --base origin/main --head HEAD --pr-body-file /tmp/omi-pr-10269-followup.md --format text` — passed - `git diff --check origin/main...HEAD` — passed - bounded pre-push gate — passed ## Safety - Beta-only architecture is unchanged - no candidate assets, tags, release metadata, admission state, or appcast pointers are modified - Stable remains untouched - this PR does not build, release, deploy, qualify, promote, or enable admission <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/BasedHardware/omi/pull/10271?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
![https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source](https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source){kind=link}
![https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img](https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img){kind=link}
![https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a](https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a){kind=link}
1 participant
Summary
--no-promoteargument from the trusted desktop Beta qualification workflowqualify-desktop-beta.shFailure-Class: FC-workflow-script-input-contract
Failure mechanism
The trusted qualification workflow invoked
qualify-desktop-beta.shwith--no-promote, but that script's declared CLI rejects the option before qualification begins. The script already has no promotion authority when--github-actions-artifactis used; it qualifies the candidate and leaves evidence publication and the reusable promotion handoff to the workflow.Verification
python3 .github/scripts/test_desktop_release_flow_contract.py -v— 6 passedactionlint -shellcheck '' .github/workflows/desktop_qualify_beta.yml— passedmake preflight— 12 selected checks passedSafety