release: give the dispatch tag input an explicit type #234

Merged

stephen merged 1 commit from fix/dispatch-input-type into main

2026-07-30 02:46:38 +00:00

stephen commented

2026-07-30 02:32:42 +00:00

Owner

Problem

workflow_dispatch declares tag with description and required but no type. Forgejo's Run workflow form switches on type to choose a widget, so with none it renders Invalid input type "" and emits no field at all. The required input cannot be supplied, and the workflow cannot be dispatched.

That makes the recovery path #233 exists to provide unreachable, including from inside itself. The guard job files an issue whose remedy reads:

re-release without moving the tag: dispatch the release workflow from the default branch with tag: $TAG.

Which was a dead end.

Fix

type: string, plus a comment on why the field is not redundant next to description and required.

Why nothing caught it

Nothing could, and that is worth stating so the next person does not go looking for the test that should have failed. The YAML is valid, all four jobs parse, and a tag push never reads the workflow_dispatch block. The defect exists only in the dispatch form, which no job renders.

Blast radius

tag is the only dispatch input in the repository: ci.yml and forseti-review.yml declare no workflow_dispatch. The only reference to it anywhere in release.yml is the inputs.tag || github.ref_name fallback in prepare, and the four github.* context fields the file reads (server_url, repository, run_number, ref_name) are populated on both a tag push and a dispatch. So nothing else in the file assumes something the form cannot supply.

If inputs.tag were somehow empty on a dispatch, RAW_TAG becomes the dispatching branch name, which prepare rejects twice over: not v<major>.<minor>.<patch>, and not present in the tags collection. It fails closed.

Note on the branch

This was meant to go straight to main. main is protected with enable_push: false and an empty push whitelist, so a direct push is refused regardless of who makes it, hence the PR. The commit is signed and require_signed_commits is satisfied. required_approvals is 0, so this can merge as soon as checks pass.

Refs #232

## Problem `workflow_dispatch` declares `tag` with `description` and `required` but no `type`. Forgejo's Run workflow form switches on `type` to choose a widget, so with none it renders `Invalid input type ""` and emits no field at all. The required input cannot be supplied, and the workflow cannot be dispatched. That makes the recovery path #233 exists to provide unreachable, including from inside itself. The `guard` job files an issue whose remedy reads: > re-release without moving the tag: dispatch the release workflow from the default branch with `tag: $TAG`. Which was a dead end. ## Fix `type: string`, plus a comment on why the field is not redundant next to `description` and `required`. ## Why nothing caught it Nothing could, and that is worth stating so the next person does not go looking for the test that should have failed. The YAML is valid, all four jobs parse, and a tag push never reads the `workflow_dispatch` block. The defect exists only in the dispatch form, which no job renders. ## Blast radius `tag` is the only dispatch input in the repository: `ci.yml` and `forseti-review.yml` declare no `workflow_dispatch`. The only reference to it anywhere in `release.yml` is the `inputs.tag || github.ref_name` fallback in `prepare`, and the four `github.*` context fields the file reads (`server_url`, `repository`, `run_number`, `ref_name`) are populated on both a tag push and a dispatch. So nothing else in the file assumes something the form cannot supply. If `inputs.tag` were somehow empty on a dispatch, `RAW_TAG` becomes the dispatching branch name, which `prepare` rejects twice over: not `v<major>.<minor>.<patch>`, and not present in the tags collection. It fails closed. ## Note on the branch This was meant to go straight to main. `main` is protected with `enable_push: false` and an empty push whitelist, so a direct push is refused regardless of who makes it, hence the PR. The commit is signed and `require_signed_commits` is satisfied. `required_approvals` is 0, so this can merge as soon as checks pass. Refs #232

stephen added 1 commit

2026-07-30 02:32:42 +00:00

release: give the dispatch tag input an explicit type

Forseti review / forseti review (advisory) (pull_request_target) Successful in 7s

Details

ci / check (pull_request) Successful in 10m33s

Details

ci / live-e2e (pull_request) Successful in 2m0s

Details

ci / coverage (pull_request) Successful in 2m19s

Details

2b2e551305

Forgejo's Run workflow form switches on an input's `type` to choose a
widget. With none it renders `Invalid input type ""` and emits no field,
so the required `tag` input could not be supplied and the workflow could
not be dispatched at all.

That made the recovery path this workflow exists to provide unreachable,
including from inside itself: the guard job files an issue whose remedy
reads "dispatch the release workflow from the default branch with
`tag: $TAG`", which was a dead end.

Nothing caught it because nothing could. The YAML is valid, all four
jobs parse, and a tag push never reads the workflow_dispatch block, so
the defect is visible only in the dispatch form. Left a comment saying
so, since the field looks redundant next to `description` and `required`.

`tag` is the only dispatch input in the repository; ci.yml and
forseti-review.yml declare no workflow_dispatch. The only reference to it
anywhere is the `inputs.tag || github.ref_name` fallback in prepare, and
the four github context fields this file reads are populated on both
triggers, so nothing else here depends on something the form cannot
supply.

Refs #232

forgejo-actions commented

2026-07-30 02:32:49 +00:00

Forseti review

No blocking findings from the lead reviewer.

No inline findings.

PR: rasterstate/fj#234
Head SHA: 2b2e551305f2
Review job: sha256:e94dc8b8f21a9f6198fc22f5a39bd9f76312c457f4615aca7c4390d87cbf0182
Provider pair: openai:gpt-5.5+anthropic:claude-haiku-4-5-20251001
Blocking findings: 0
Inline findings: 0
Token source: GITHUB_TOKEN
Runner: f4ed4378e213
Run: https://rasterhub.com/rasterstate/fj/actions/runs/407

## Forseti review No blocking findings from the lead reviewer. _No inline findings._ - PR: `rasterstate/fj#234` - Head SHA: `2b2e551305f2` - Review job: `sha256:e94dc8b8f21a9f6198fc22f5a39bd9f76312c457f4615aca7c4390d87cbf0182` - Provider pair: `openai:gpt-5.5+anthropic:claude-haiku-4-5-20251001` - Blocking findings: `0` - Inline findings: `0` - Token source: `GITHUB_TOKEN` - Runner: `f4ed4378e213` - Run: https://rasterhub.com/rasterstate/fj/actions/runs/407

forgejo-actions approved these changes

2026-07-30 02:32:50 +00:00

forgejo-actions left a comment

Forseti review

No blocking findings from the lead reviewer.

No inline findings.

PR: rasterstate/fj#234
Head SHA: 2b2e551305f2
Review job: sha256:e94dc8b8f21a9f6198fc22f5a39bd9f76312c457f4615aca7c4390d87cbf0182
Provider pair: openai:gpt-5.5+anthropic:claude-haiku-4-5-20251001
Blocking findings: 0
Inline findings: 0
Token source: GITHUB_TOKEN
Runner: f4ed4378e213
Run: https://rasterhub.com/rasterstate/fj/actions/runs/407