deer-flow/.github/workflows/verify-versions.yml
Hyeonsang Cho db9b0b4bf0
fix(release): reject a stale backend/uv.lock in the version gate (#6588)
* fix(release): reject a stale backend/uv.lock in the version gate

verify_versions.sh compared only Chart.yaml, pyproject.toml and
package.json, so bumping those three by hand passed the v* gate while
backend/uv.lock still recorded the previous root package version. The
backend image installs with uv sync --locked, so the chart and the other
images published while the backend image failed to build.

Run uv lock --check in backend/ as part of the gate, letting uv own the
PEP 440 normalization, and fail when uv is missing. The reusable
verify-versions workflow installs the uv version the backend image pins.

* docs(changelog): reference #6588

* fix(release): explain an unparsed lock version and stop blaming the lock for every uv failure

Print a fallback when the lock's root entry is not found, so the job log
does not show an empty field, and word the uv lock --check annotation so a
network error or uv crash is not reported as a stale lock.
2026-10-10 14:05:35 +08:00

35 lines
1.2 KiB
YAML

name: Verify Versions
# Reusable workflow: checks that every project version source agrees with the
# git tag that triggered the release. Called by chart.yaml and container.yaml
# on v* tags so a forgotten version bump blocks the entire release (container
# images + chart), not just the chart.
#
# Sources verified: deploy/helm/deer-flow/Chart.yaml (version + appVersion),
# backend/pyproject.toml, frontend/package.json, and backend/uv.lock (via
# `uv lock --check`, which the backend image's `uv sync --locked` depends on).
# Logic lives in scripts/verify_versions.sh so it can also be run locally.
on:
workflow_call:
jobs:
verify-versions:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
- name: Install uv
uses: astral-sh/setup-uv@v7
with:
# Must match backend/Dockerfile's UV_IMAGE tag; pinned by backend/tests/test_ci_uv_version_pin.py
version: "0.11.1"
- name: Verify all version sources match tag
run: |
TAG_VERSION="${GITHUB_REF_NAME#v}"
bash scripts/verify_versions.sh "$TAG_VERSION"