This is an automated email from the ASF dual-hosted git repository.
kaxil pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 00897381170 Fix registry publish silently skipping for some docs
publishers (#70645)
00897381170 is described below
commit 00897381170be699bcc3c5c28ee727ac2f4b76b9
Author: Kaxil Naik <[email protected]>
AuthorDate: Wed Jul 29 15:49:05 2026 +0100
Fix registry publish silently skipping for some docs publishers (#70645)
`registry-build.yml` gated both of its jobs on
`github.event_name == 'workflow_call' || <committer allowlist>`, intending
to
skip the allowlist check when another workflow calls it. That disjunct never
fires: the `github` context in a called workflow is the caller's, so
`github.event_name` reports the caller's event (`workflow_dispatch`), not
`workflow_call`. The same rule is why `github.event.sender.login` resolves
to
the caller's dispatcher here in the first place.
The effect is that the allowlist in this file is enforced on the
`workflow_call` path too, against a copy that has drifted from the one on
`build-info` in `publish-docs-to-s3.yml`. That list also has
`vatsrahul1001`,
who publishes docs regularly, so a provider wave they dispatch would publish
the docs and silently skip the registry update.
Replace the check with an input declared only under `workflow_call`, which
is
the reliable way to tell the entry points apart, and let the caller's own
allowlist stand rather than re-checking against a second copy that has to be
kept in sync by hand.
---
.github/workflows/registry-build.yml | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/registry-build.yml
b/.github/workflows/registry-build.yml
index 6db2b891cd2..c5bae276172 100644
--- a/.github/workflows/registry-build.yml
+++ b/.github/workflows/registry-build.yml
@@ -60,6 +60,15 @@ on: # yamllint disable-line rule:truthy
required: false
type: boolean
default: false
+ # `github.event_name` inside a called workflow reports the *caller's*
event, never
+ # `workflow_call`, so it cannot distinguish the two entry points. An
input declared
+ # only here can: it defaults to true when called and is undefined
(falsy) on a
+ # `workflow_dispatch`. Callers must not pass it.
+ is-workflow-call:
+ description: "Internal: always true on the workflow_call path, do not
pass explicitly"
+ required: false
+ type: boolean
+ default: true
image-stash-ref:
description: >
Ref whose CI image stash to use (empty = the per-branch one). Set it
to whatever the
@@ -89,7 +98,7 @@ jobs:
# such image and still builds its own.
if: >
(inputs.ci-image-already-built != true) && (
- github.event_name == 'workflow_call' ||
+ inputs.is-workflow-call ||
contains(fromJSON('[
"ashb",
"bugraoz93",
@@ -125,11 +134,12 @@ jobs:
name: "Build & Publish Registry"
needs: [build-ci-image]
# `build-ci-image` is skipped when the caller stashed the image, so this
cannot simply
- # inherit its result — but it must keep enforcing the same committer
allowlist that
- # skipping that job used to enforce for us on a dispatch.
+ # inherit its result. On a dispatch it enforces the committer allowlist
below; on the
+ # `workflow_call` path the caller has already gated on its own allowlist,
so this must
+ # not re-check it against a second, separately-maintained copy.
if: >
!cancelled() && needs.build-ci-image.result != 'failure' && (
- github.event_name == 'workflow_call' ||
+ inputs.is-workflow-call ||
contains(fromJSON('[
"ashb",
"bugraoz93",
