From 21cbcc77f2193303e303f3b8e3476171f993ad5c Mon Sep 17 00:00:00 2001
From: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Date: Thu, 22 Oct 2026 07:26:04 +0200
Subject: [PATCH 1/2] ci(release): a beta needs a full site test on its exact
 commit

native-release.yml now refuses to publish a beta unless the job
"site full" of site.yml succeeded on the source commit: every scenario
of go/test/site against device-simulator, with known failures still
failing. A dry run warns instead. Stable promotes a tested beta and is
unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/native-release.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/.github/workflows/native-release.yml b/.github/workflows/native-release.yml
index ecf4c8d8..871d83e6 100644
--- a/.github/workflows/native-release.yml
+++ b/.github/workflows/native-release.yml
@@ -24,6 +24,7 @@ on:
 
 permissions:
   contents: write
+  checks: read
 
 concurrency:
   group: native-release-${{ inputs.tag }}
@@ -122,6 +123,30 @@ jobs:
             "${RUNNER_TEMP}/native-release-pages.json"
           printf 'tag=%s\ncommit=%s\nschema=%s\n' "${TAG}" "${source_commit}" "${schema}" >> "${GITHUB_OUTPUT}"
         id: source
+      # A beta publishes only a commit on which every site-test scenario
+      # passed (site.yml, go/test/site): the job "site full" of a nightly or
+      # dispatched run. A stable promotes a beta, which already passed.
+      - name: Require a full site test on the exact source
+        if: ${{ inputs.channel == 'beta' }}
+        env:
+          SOURCE_COMMIT: ${{ steps.source.outputs.commit }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          passed=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${SOURCE_COMMIT}/check-runs?check_name=site%20full&filter=all&per_page=100" \
+            --jq '[.check_runs[] | select(.app.slug == "github-actions" and .conclusion == "success")] | length')
+          if [ "${passed}" -gt 0 ]; then
+            echo "Full site test passed on ${SOURCE_COMMIT}."
+            exit 0
+          fi
+          msg="no passing full site test on ${SOURCE_COMMIT}. Run: gh workflow run site.yml --ref master -f set=full, and wait for its \"site full\" job"
+          if [ "${DRY_RUN}" = true ]; then
+            echo "::warning::${msg}"
+            exit 0
+          fi
+          echo "::error::${msg}"
+          exit 1
       - name: Build complete ARM64 and AMD64 packages
         env:
           TAG: ${{ inputs.tag }}

From 02de4f3cc677f02505758a416e2e0697496019ed Mon Sep 17 00:00:00 2001
From: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Date: Thu, 22 Oct 2026 09:37:49 +0200
Subject: [PATCH 2/2] ci(release): read the siterig/full commit status, not a
 workflow check

The rig no longer runs in GitHub Actions (Fredrik, 22 Oct). A runner on
its own machine posts the commit status siterig/full after a full run of
a commit, and the beta gate reads that status: the latest siterig/full on
the source commit must be success. The step reads; it never runs the rig.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/native-release.yml | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/native-release.yml b/.github/workflows/native-release.yml
index 871d83e6..34546c84 100644
--- a/.github/workflows/native-release.yml
+++ b/.github/workflows/native-release.yml
@@ -24,7 +24,7 @@ on:
 
 permissions:
   contents: write
-  checks: read
+  statuses: read
 
 concurrency:
   group: native-release-${{ inputs.tag }}
@@ -124,9 +124,11 @@ jobs:
           printf 'tag=%s\ncommit=%s\nschema=%s\n' "${TAG}" "${source_commit}" "${schema}" >> "${GITHUB_OUTPUT}"
         id: source
       # A beta publishes only a commit on which every site-test scenario
-      # passed (site.yml, go/test/site): the job "site full" of a nightly or
-      # dispatched run. A stable promotes a beta, which already passed.
-      - name: Require a full site test on the exact source
+      # passed, with known failures still failing: the commit status
+      # siterig/full that the site-test runner (go/test/site/runner) posts
+      # from its own machine. This step only reads it. Stable promotes a
+      # beta, whose commit already passed.
+      - name: Require siterig/full on the exact source
         if: ${{ inputs.channel == 'beta' }}
         env:
           SOURCE_COMMIT: ${{ steps.source.outputs.commit }}
@@ -134,13 +136,14 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          passed=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${SOURCE_COMMIT}/check-runs?check_name=site%20full&filter=all&per_page=100" \
-            --jq '[.check_runs[] | select(.app.slug == "github-actions" and .conclusion == "success")] | length')
-          if [ "${passed}" -gt 0 ]; then
-            echo "Full site test passed on ${SOURCE_COMMIT}."
+          # Statuses come newest first; the latest siterig/full counts.
+          state=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${SOURCE_COMMIT}/statuses?per_page=100" \
+            --jq '[.[] | select(.context == "siterig/full")][0].state // "missing"')
+          if [ "${state}" = success ]; then
+            echo "siterig/full is success on ${SOURCE_COMMIT}."
             exit 0
           fi
-          msg="no passing full site test on ${SOURCE_COMMIT}. Run: gh workflow run site.yml --ref master -f set=full, and wait for its \"site full\" job"
+          msg="siterig/full is ${state} on ${SOURCE_COMMIT}; the site-test runner posts it after a full run of that commit (go/test/site/runner/README.md)"
           if [ "${DRY_RUN}" = true ]; then
             echo "::warning::${msg}"
             exit 0