Add workflow to promote artifacts upon QA-approval by seriAlizations · Pull Request #241 · IONOS-Productivity/ncw-server

seriAlizations · 2026-02-12T14:33:08Z

Resolves: #

Summary

TODO

...

Checklist

Code is properly formatted
Sign-off message is added to all commits
Tests (unit, integration, api and/or acceptance) are included
Screenshots before/after for front-end changes
Documentation (manuals or wiki) has been updated or is not required
Backports requested where applicable (ex: critical bugfixes)

Copilot

Pull request overview

This PR adds a GitHub Actions workflow to promote QA-approved artifacts from the development branch to the stable branch. The workflow ensures that artifacts are promoted without rebuilding, maintaining the exact same commit SHA throughout the process.

Changes:

Adds a new workflow that performs a fast-forward merge from ionos-dev to ionos-stable
Implements artifact promotion from snapshot repository to release repository in Artifactory
Includes verification steps to ensure the SHA exists in the development branch before promotion

.github/workflows/promote-artifact.yml

upon QA-approval Signed-off-by: Aliza Held <aliza.held@strato.de>

Signed-off-by: Aliza Held <aliza.held@strato.de>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

.github/workflows/promote-artifact.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Aliza Held <124045671+seriAlizations@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 8 comments.

.github/workflows/promote-artifact.yml

lara-fernandezcueto · 2026-03-11T15:27:52Z

I took a look at the pipeline and it looks good to me

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-11T15:27:58Z

.github/workflows/promote-artifact.yml

+          # Expected Artifactory layout:
+          # ionos-productivity-ncwserver-snapshot/
+          #   dev/<branch-name>/$SHA/<artifact-files>
+          #
+          # We search for a single .tar.gz artifact for the given SHA and
+          # derive its containing directory. This avoids using wildcards
+          # for the branch component when copying to the release repo.
+          set -e
+          SEARCH_RESULT=$(jf rt search --format=json --limit=2 "${{ env.ARTIFACTORY_REPOSITORY_SNAPSHOT }}/dev/*/$SHA/*.tar.gz")
+          MATCH_COUNT=$(echo "$SEARCH_RESULT" | jq '.results | length')
+
+          if [ "$MATCH_COUNT" -eq 0 ]; then
+            echo "No artifact with SHA $SHA found."
+            exit 1
+          fi
+
+          if [ "$MATCH_COUNT" -gt 1 ]; then
+            echo "Multiple artifacts found for SHA $SHA; expected exactly one."
+            echo "$SEARCH_RESULT"
+            exit 1
+          fi
+
+          ARTIFACT_REPO=$(echo "$SEARCH_RESULT" | jq -r '.results[0].repo')
+          ARTIFACT_PATH=$(echo "$SEARCH_RESULT" | jq -r '.results[0].path')
+          # Derive the directory that contains all artifacts for this SHA
+          ARTIFACT_DIR_PATH=$(dirname "$ARTIFACT_PATH")
+          ARTIFACT_DIR="$ARTIFACT_REPO/$ARTIFACT_DIR_PATH"
+
+          echo "Using artifact directory: $ARTIFACT_DIR"
+          # Expose the directory as a step output for the copy step
+          echo "artifact_dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"
+      - name: Copy artifact to target
+        id: copy_artifact
+        run: |
+          jf rt copy \
+          "${{ steps.find_artifact.outputs.artifact_dir }}/*" \
+          "${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${SHA}/"
+
+      - name: Confirm promoted artifacts
+        run: |
+          jf rt search --format=table "${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${SHA}/*"


The Artifactory search pattern here (.../dev/*/$SHA/*.tar.gz) doesn’t match the layout used by .github/workflows/build-artifact.yml when uploading the workspace artifact (stored as nc-workspace.zip under <stage>/ncw-<ncVersion>/<shortSha>/...). With the current path/extension and use of full SHA, this step will fail to find the QA-approved build. Update the search/copy logic to follow the actual upload structure (including using the short SHA if that’s what the upload uses).

Suggested change

# Expected Artifactory layout:

# ionos-productivity-ncwserver-snapshot/

# dev/<branch-name>/$SHA/<artifact-files>

#

# We search for a single .tar.gz artifact for the given SHA and

# derive its containing directory. This avoids using wildcards

# for the branch component when copying to the release repo.

set -e

SEARCH_RESULT=$(jf rt search --format=json --limit=2 "${{ env.ARTIFACTORY_REPOSITORY_SNAPSHOT }}/dev/*/$SHA/*.tar.gz")

MATCH_COUNT=$(echo "$SEARCH_RESULT" | jq '.results | length')

if [ "$MATCH_COUNT" -eq 0 ]; then

echo "No artifact with SHA $SHA found."

exit 1

fi

if [ "$MATCH_COUNT" -gt 1 ]; then

echo "Multiple artifacts found for SHA $SHA; expected exactly one."

echo "$SEARCH_RESULT"

exit 1

fi

ARTIFACT_REPO=$(echo "$SEARCH_RESULT" | jq -r '.results[0].repo')

ARTIFACT_PATH=$(echo "$SEARCH_RESULT" | jq -r '.results[0].path')

# Derive the directory that contains all artifacts for this SHA

ARTIFACT_DIR_PATH=$(dirname "$ARTIFACT_PATH")

ARTIFACT_DIR="$ARTIFACT_REPO/$ARTIFACT_DIR_PATH"

echo "Using artifact directory: $ARTIFACT_DIR"

# Expose the directory as a step output for the copy step

echo "artifact_dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"

- name: Copy artifact to target

id: copy_artifact

run: |

jf rt copy \

"${{ steps.find_artifact.outputs.artifact_dir }}/*" \

"${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${SHA}/"

- name: Confirm promoted artifacts

run: |

jf rt search --format=table "${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${SHA}/*"

# Expected Artifactory layout (from build-artifact.yml):

# ionos-productivity-ncwserver-snapshot/

# <stage>/ncw-<ncVersion>/<shortSha>/nc-workspace.zip

#

# We derive the short SHA from the full SHA provided as input,

# search for the nc-workspace.zip artifact for that short SHA,

# and then derive its containing directory. This avoids using

# wildcards for the version component when copying to the release repo.

set -e

SHORT_SHA=${SHA:0:7}

SEARCH_RESULT=$(jf rt search --format=json --limit=2 "${{ env.ARTIFACTORY_REPOSITORY_SNAPSHOT }}/*/ncw-*/*${SHORT_SHA}/nc-workspace.zip")

MATCH_COUNT=$(echo "$SEARCH_RESULT" | jq '.results | length')

if [ "$MATCH_COUNT" -eq 0 ]; then

echo "No artifact with short SHA $SHORT_SHA (from $SHA) found."

exit 1

fi

if [ "$MATCH_COUNT" -gt 1 ]; then

echo "Multiple artifacts found for short SHA $SHORT_SHA (from $SHA); expected exactly one."

echo "$SEARCH_RESULT"

exit 1

fi

ARTIFACT_REPO=$(echo "$SEARCH_RESULT" | jq -r '.results[0].repo')

ARTIFACT_PATH=$(echo "$SEARCH_RESULT" | jq -r '.results[0].path')

# Derive the directory that contains all artifacts for this short SHA

ARTIFACT_DIR_PATH=$(dirname "$ARTIFACT_PATH")

ARTIFACT_DIR="$ARTIFACT_REPO/$ARTIFACT_DIR_PATH"

echo "Using artifact directory: $ARTIFACT_DIR"

# Expose the directory and short SHA as step outputs for subsequent steps

echo "artifact_dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"

echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"

- name: Copy artifact to target

id: copy_artifact

run: |

jf rt copy \

"${{ steps.find_artifact.outputs.artifact_dir }}/*" \

"${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${{ steps.find_artifact.outputs.short_sha }}/"

- name: Confirm promoted artifacts

run: |

jf rt search --format=table "${{ env.ARTIFACTORY_REPOSITORY_RELEASE }}/stable/${{ steps.find_artifact.outputs.short_sha }}/*"

Copilot · 2026-03-11T15:27:58Z

.github/workflows/promote-artifact.yml

+          # We search for a single .tar.gz artifact for the given SHA and
+          # derive its containing directory. This avoids using wildcards
+          # for the branch component when copying to the release repo.
+          set -e


This step uses set -e but relies on pipelines like echo "$SEARCH_RESULT" | jq ...; without set -o pipefail (and ideally -u), jq parse failures can be ignored and lead to misleading behavior downstream. Switch to set -euo pipefail (consistent with earlier steps) so JSON parsing errors fail the job.

Suggested change

set -e

set -euo pipefail

Copilot · 2026-03-11T15:27:59Z

.github/workflows/promote-artifact.yml

+  # Copy specified artifact to the release repo -> No rebuild
+  # (ionos-productivity-ncwserver-release)
+    needs: promote-git
+    runs-on: ubuntu-latest
+    steps: 


Job ordering makes the git fast-forward/push happen before the Artifactory copy (promote-artifact depends on promote-git). If the artifact copy fails (missing artifact, JFrog outage, permission issue), ionos-stable will already have advanced, leaving the stable branch and release artifacts out of sync. Consider promoting/verifying artifacts first and only pushing ionos-stable after the copy succeeds (or otherwise enforce atomicity).

Copilot · 2026-03-11T15:27:59Z

.github/workflows/promote-artifact.yml

+      sha:
+        description: 'Commit SHA to promote from ionos-dev to ionos-stable and copy artifacts for'
+        required: true
+        type: string
+env: 
+  SHA: ${{ inputs.sha }}
+  ARTIFACTORY_REPOSITORY_SNAPSHOT: ionos-productivity-ncwserver-snapshot


inputs.sha is accepted as an arbitrary git revision (e.g., a ref like origin/ionos-dev or HEAD), not strictly a commit hash. That can promote a moving target or an unintended commit. Validate the input to only allow a full 40-hex commit SHA (and derive SHORT_SHA=${SHA:0:7} from it if needed for artifact paths).

printminion-co added this to the ncw-4 milestone Feb 12, 2026

printminion-co force-pushed the ah/dev/promote-qa-approved-artifacts branch from da01fa6 to 5e211e0 Compare February 12, 2026 17:02

printminion-co requested a review from Copilot February 12, 2026 17:02

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Arsalanulhaq force-pushed the rc/ncw-4 branch from 978980a to 316d3e0 Compare February 26, 2026 11:27

seriAlizations added 2 commits February 27, 2026 15:29

IONOS(ci): Add workflow to promote artifacts

acf0d8c

upon QA-approval Signed-off-by: Aliza Held <aliza.held@strato.de>

IONOS(ci): Update to integrate feedback

a120461

Signed-off-by: Aliza Held <aliza.held@strato.de>

seriAlizations force-pushed the ah/dev/promote-qa-approved-artifacts branch from e291e5a to a120461 Compare February 27, 2026 14:30

seriAlizations requested a review from Copilot February 27, 2026 14:30

Copilot started reviewing on behalf of seriAlizations February 27, 2026 14:31 View session

Copilot AI reviewed Feb 27, 2026

View reviewed changes

Apply suggestions from code review

8e14303

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Aliza Held <124045671+seriAlizations@users.noreply.github.com>

seriAlizations requested a review from Copilot March 3, 2026 11:04

Copilot started reviewing on behalf of seriAlizations March 3, 2026 11:05 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

Base automatically changed from rc/ncw-4 to ionos-dev March 4, 2026 09:41

seriAlizations requested a review from Copilot March 11, 2026 15:22

Copilot started reviewing on behalf of seriAlizations March 11, 2026 15:23 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Conversation

seriAlizations commented Feb 12, 2026

Summary

TODO

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lara-fernandezcueto commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lara-fernandezcueto commented Mar 11, 2026 •

edited

Loading