Avoid publishing a package before tagging it
In an accident, I ran /chatops run publish --security 16.8.4
before running /chatops run release tag --security 16.8.4
, and even though the ChatOps command failed at some point, the sync from security
to canonical
did happen, thus leaked the security patches before the packages are released. More details in the job log: https://ops.gitlab.net/gitlab-org/release/tools/-/jobs/13080695
Thus, we should change the logic of /chatops run publish --security
to check first if the tag exists before performing the sync from security
to canonical
.
Exit Criteria
-
/chatops run publish --security
fails without performing any write actions (write, push, sync, etc.) if the corresponding/chatops run release tag --security
command has not been executed successfully.