Skip to content

Repository navigation

🐛🧑‍💻 - Release and hotfix publication callbacks omit live merge queue attestations #643

New issue
New issue
Closed
Bug
#649
Closed
🐛🧑‍💻 - Release and hotfix publication callbacks omit live merge queue attestations#643
Bug
#649
Assignees
efraespada
Labels
100%Progress: 100%branchedIndicates that a branch has been created for this issue.bugSomething isn't workingbugfixSomething isn't workingpriority: highCritical issue, needs immediate attention.size: LIndicates a large-sized task or issue that requires significant effort and time.

Description

@efraespada
efraespada
opened on Oct 21, 2026

Is there an existing issue for this?

  • I have searched the existing issues.

Which actions are affected?

Issue, Pull Request

Which platforms are affected?

Linux

Description

The consumer release/hotfix templates pass MERGE_QUEUE_CHECK_ATTESTATIONS to preparation and reconciliation-only resume, but omit merge-queue-check-attestations on the normal published_deployment_action call. Publication confirmation starts reconciliation and must receive the live policy for the actual target. With a required producer that needs an exact attestation, the normal publish route can fall back to the default empty array even though preparation/resume use the configured policy.

Expected: the normal publication callback receives the same live Repository Variable as preparation, resume and the managed-PR continuation. Keep target rules, exact identity validation and fail-closed handling intact.

Reproducing the issue

  1. Inspect setup/workflows/release_workflow.yml and setup/workflows/hotfix_workflow.yml on current master/v3.
  2. Configure a legitimate exact MERGE_QUEUE_CHECK_ATTESTATIONS entry for a required producer on the development or active-release target.
  3. Compare prepare_deployment_action and the resume published_deployment_action inputs with the normal publish published_deployment_action inputs.
  4. The normal callback omits the attestation input. Add contract tests requiring the live variable on all paths that initiate reconciliation.

Minimal missing input under the normal callback:

merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}

copilot Version

Consumer installed with CLI 3.9.3 and vypdev/copilot@v3. Current master generic consumer templates inspected on 2026-10-21. This is a static contract finding, not a claim that a production release was executed with a third-party check.

Additional context and comments

Found while completing the documented deployment extension points for vypdev/homeassistant-gateway#19. No release was launched, no protections bypassed and no generic Copilot event workflow modified.

The deployment documentation explicitly says attestations are live policy and must be reread at each readiness decision: https://github.com/vypdev/copilot/blob/master/docs/issues/deployment-orchestration.mdx#setup-file-and-repository-variable-mapping

Source templates:

Activity

  1. efraespada
    added
    bugSomething isn't working
    bugfixSomething isn't working
    priority: highCritical issue, needs immediate attention.
    on Oct 21, 2026
  2. vypbot
    assigned
    efraespada
    on Oct 21, 2026
  3. vypbot
    added the
    Bug
    issue type on Oct 21, 2026
  4. vypbot
    added this to vypdevon Oct 21, 2026
  5. vypbot
    moved this to Todo in vypdevon Oct 21, 2026
  6. vypbot
    changed the title [-]Release and hotfix publication callbacks omit live merge queue attestations[/-] [+]🐛 - Release and hotfix publication callbacks omit live merge queue attestations[/+] on Oct 21, 2026
  7. vypbot
    added
    state:ai-processing
    and removed
    state:ai-processing
    on Oct 21, 2026

  8. vypbot commented on Oct 21, 2026

    @vypbot
    vypbot
    on Oct 21, 2026
    Contributor

    Hi! I’m @vypbot, the Copilot assistant for this repository.

    I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.

    Try /copilot help to see the available commands, or mention @vypbot with your question.

  9. efraespada
    added
    in-progressStart work on an admitted issue.
    on Oct 21, 2026
  10. vypbot
    moved this from Todo to In Progress in vypdevon Oct 21, 2026
  11. vypbot
    added
    branchedIndicates that a branch has been created for this issue.
    on Oct 21, 2026
  12. vypbot
    changed the title [-]🐛 - Release and hotfix publication callbacks omit live merge queue attestations[/-] [+]🐛🧑‍💻 - Release and hotfix publication callbacks omit live merge queue attestations[/+] on Oct 21, 2026
  13. vypbot
    added
    state:workingWork can proceed on the verified branch or without a branch.
    on Oct 21, 2026

  14. vypbot commented on Oct 21, 2026

    @vypbot
    vypbot
    on Oct 21, 2026
    Contributor

    Implementation plan

    Current status: Ready to start. No action is required from maintainers before implementation.

    1. Pass live attestations on publication
      • Add merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }} to the normal published_deployment_action call in setup/workflows/release_workflow.yml and setup/workflows/hotfix_workflow.yml.
    2. Extend workflow contract coverage
      • Update the workflow contract tests to require the live Repository Variable on each reconciliation-initiating path, including normal publication, resume, and managed-PR continuation.
    3. Preserve readiness safeguards
      • Keep target-specific rules, exact attestation identity validation, and fail-closed handling unchanged while fixing the workflow inputs.
    4. Align deployment documentation
      • Confirm the documented live-policy behavior in docs/issues/deployment-orchestration.mdx matches the normal publication, resume, and continuation paths.

    Acceptance: Workflow contract tests verify that both release and hotfix normal published_deployment_action calls pass merge-queue-check-attestations from vars.MERGE_QUEUE_CHECK_ATTESTATIONS with the [] fallback, and that existing readiness safeguards remain covered.

    Need something else? Mention the bot with a question or use /copilot help.

  15. vypbot
    added
    state:ai-processing
    size: LIndicates a large-sized task or issue that requires significant effort and time.
    95%Progress: 95%
    and removed
    state:ai-processing
    on Oct 21, 2026

  16. vypbot commented on Oct 21, 2026

    @vypbot
    vypbot
    on Oct 21, 2026
    Contributor

    Issue closed — historical progress

    Current status: closed as completed.

    The last estimate is retained below as history. Closure does not certify a new percentage, tests, or branch alignment.

    Action required: none for this closed issue. If work continues, reopen the issue; a fresh assessment can update this same card.

    Last assessment before closure (historical)

    Progress: 95% — in progress

    > Current status: The release and hotfix publication callbacks now pass the live attestation variable with the [] fallback. Contract checks, mutation cases, and documentation were updated, and the readiness safeguards are not changed in the supplied patches. The comparison does not establish that tests or workflow validation passed.

    Next: Run the workflow contract tests and validate the canonical workflows to confirm the changes pass.

  17. efraespada
    linked a pull request that will close this issuefix: forward live queue attestations on publication #649on Oct 21, 2026
  18. vypbot
    closed this as completedon Oct 21, 2026

  19. vypbot commented on Oct 21, 2026

    @vypbot
    vypbot
    on Oct 21, 2026
    Contributor

    Issue closed: synchronization recommendation retired

    No branch synchronization is required for this closed issue.

    The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.

  20. vypbot
    removed
    95%Progress: 95%
    on Oct 21, 2026
  21. github-project-automation
    moved this from In Progress to Done in vypdevon Oct 21, 2026
  22. vypbot
    added
    100%Progress: 100%
    and removed
    in-progressStart work on an admitted issue.
    state:workingWork can proceed on the verified branch or without a branch.
    on Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

100%Progress: 100%branchedIndicates that a branch has been created for this issue.bugSomething isn't workingbugfixSomething isn't workingpriority: highCritical issue, needs immediate attention.size: LIndicates a large-sized task or issue that requires significant effort and time.

Type

Bug

Projects

  • vypdev
    Status
    Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions