From bd9b94d5c329bd133bec7e3d82f91b1c791f62c3 Mon Sep 17 00:00:00 2001
From: jamieplu <179417684+jamieplu@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:15:47 -0500
Subject: [PATCH] Rebase release-notes commits onto master before pushing

The cloud release-notes job lost a push race on v1.0.219 and the page
was silently discarded: run 30842563575 generated
content/en/cloud/reference/releases/v1.0.219.md, committed it locally as
bd9c2a5d, then git-auto-commit-action's push was rejected
non-fast-forward because layer5io/meshery-cloud's chart publisher had
landed b45c8829 on master fifteen seconds earlier. The job failed, the
commit went with the runner, and docs.layer5.io/cloud/reference/releases/v1.0.219
404'd.

The window is wider than the race suggests. The checkout step is pinned
to the SHA the run was dispatched at, so every commit landing on master
between dispatch and push guarantees a stale base - rerunning the failed
job reproduces the rejection deterministically rather than clearing it.
git-auto-commit-action neither pulls nor retries, so a stale base is
terminal.

Replay the job's own commit on the current tip before the action pushes.
Both jobs write only their version file and their own release-notes page,
which nothing else writes, so the rebase cannot conflict in practice.

The action passes its commit identity per-command and never configures
it, so the hook has to be handed the same identity or the rebase commits
under whatever ident the runner guesses.

Applied to the Kanvas release-notes dispatcher too - identical step,
identical gap.

The counterpart pusher lives in layer5io/meshery-cloud and already
fetches and retries around this same collision, so a concurrency: group
here would not reach it and is deliberately not added.

Signed-off-by: jamieplu <179417684+jamieplu@users.noreply.github.com>
---
 .github/workflows/cloud-release-docs.yml            | 13 +++++++++++++
 .../workflows/meshery-extension-release-docs.yml    | 11 +++++++++++
 2 files changed, 24 insertions(+)

diff --git a/.github/workflows/cloud-release-docs.yml b/.github/workflows/cloud-release-docs.yml
index 94694be8f01..e8a471f7208 100644
--- a/.github/workflows/cloud-release-docs.yml
+++ b/.github/workflows/cloud-release-docs.yml
@@ -48,3 +48,16 @@ jobs:
           commit_user_name: l5io
           commit_user_email: ci@layer5.io
           commit_author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          # The checkout above is pinned to the SHA this run was dispatched at,
+          # so anything landing on master while the job runs - notably the
+          # cross-repo chart publisher in layer5io/meshery-cloud - leaves this
+          # job pushing from a stale base and the release notes are lost with
+          # the rejected push. Replay this commit on the current tip first.
+          # Safe to rebase: this job only touches build/meshery-cloud.version
+          # and its own release-notes page, which nothing else writes.
+          # The action passes its identity per-command and never configures it,
+          # so the rebase has to be handed the same one or it picks up whatever
+          # the runner guesses.
+          before_push_hook: >-
+            git -c user.name="$INPUT_COMMIT_USER_NAME" -c user.email="$INPUT_COMMIT_USER_EMAIL"
+            pull --rebase --autostash origin "$INPUT_BRANCH"
diff --git a/.github/workflows/meshery-extension-release-docs.yml b/.github/workflows/meshery-extension-release-docs.yml
index 3ac26a1d888..8fcff8505d0 100644
--- a/.github/workflows/meshery-extension-release-docs.yml
+++ b/.github/workflows/meshery-extension-release-docs.yml
@@ -48,3 +48,14 @@ jobs:
           commit_user_name: l5io
           commit_user_email: ci@layer5.io
           commit_author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          # Same stale-base hazard as cloud-release-docs.yml: the checkout is
+          # pinned to the dispatch SHA, so any commit landing on master during
+          # the run makes this push non-fast-forward and discards the notes.
+          # Safe to rebase: this job only touches build/meshery-extensions.version
+          # and its own release-notes page, which nothing else writes.
+          # The action passes its identity per-command and never configures it,
+          # so the rebase has to be handed the same one or it picks up whatever
+          # the runner guesses.
+          before_push_hook: >-
+            git -c user.name="$INPUT_COMMIT_USER_NAME" -c user.email="$INPUT_COMMIT_USER_EMAIL"
+            pull --rebase --autostash origin "$INPUT_BRANCH"