enhance pipeline: add validation for release tag format and improve AI code review steps
remove duplicate lint, type and unit test validation from PR pipeline.
This commit is contained in:
sujit deokar
+26
-20
@@ -125,8 +125,10 @@ definitions:
|
||||
# BEFORE any data is written, closing the race window that exists when
|
||||
# writing first and chmodding second (default umask would expose the
|
||||
# token briefly as 644). printf (not echo) avoids a trailing newline.
|
||||
- set +x
|
||||
- install -m 600 /dev/null "$(pwd)/web-identity-token"
|
||||
- printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
|
||||
- set -x
|
||||
|
||||
# Clone the review agent repo (private — needs BITBUCKET_CLONE_TOKEN)
|
||||
# SETUP REQUIRED: set BITBUCKET_CLONE_TOKEN (marked "Secured") in
|
||||
@@ -196,6 +198,9 @@ pipelines:
|
||||
# -------------------------------------------------------------------------
|
||||
# Feature branches represent new functionality. They must go through
|
||||
# dev first for integration testing before promotion to stg/main.
|
||||
# Note: Code quality checks (lint, typecheck, unit-tests) run in the
|
||||
# default pipeline on every push. This PR pipeline validates branch
|
||||
# routing and performs AI code review only.
|
||||
"feature/*":
|
||||
# Gate steps below use atlassian/default-image:4 (not python:3.12.7)
|
||||
# because gates only run bash/shell — no Python needed. The default
|
||||
@@ -214,16 +219,15 @@ pipelines:
|
||||
[ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
|
||||
done
|
||||
echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
|
||||
- parallel:
|
||||
- step: *lint
|
||||
- step: *typecheck
|
||||
- step: *unit-tests
|
||||
- step: *ai-code-review
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
# bugfix/* → dev only
|
||||
# -------------------------------------------------------------------------
|
||||
# Bug fixes follow the same path as features — must land in dev first.
|
||||
# Note: Code quality checks (lint, typecheck, unit-tests) run in the
|
||||
# default pipeline on every push. This PR pipeline validates branch
|
||||
# routing and performs AI code review only.
|
||||
"bugfix/*":
|
||||
- step:
|
||||
name: "Gate: bugfix → dev"
|
||||
@@ -239,10 +243,6 @@ pipelines:
|
||||
[ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
|
||||
done
|
||||
echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
|
||||
- parallel:
|
||||
- step: *lint
|
||||
- step: *typecheck
|
||||
- step: *unit-tests
|
||||
- step: *ai-code-review
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
@@ -250,6 +250,9 @@ pipelines:
|
||||
# -------------------------------------------------------------------------
|
||||
# Hotfixes are urgent production fixes. They can go directly to main
|
||||
# (fast-track) or to dev (to keep the dev branch in sync).
|
||||
# Note: Code quality checks (lint, typecheck, unit-tests) run in the
|
||||
# default pipeline on every push. This PR pipeline validates branch
|
||||
# routing and performs AI code review only.
|
||||
"hotfix/*":
|
||||
- step:
|
||||
name: "Gate: hotfix → main or dev"
|
||||
@@ -265,10 +268,6 @@ pipelines:
|
||||
[ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
|
||||
done
|
||||
echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
|
||||
- parallel:
|
||||
- step: *lint
|
||||
- step: *typecheck
|
||||
- step: *unit-tests
|
||||
- step: *ai-code-review
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
@@ -276,6 +275,9 @@ pipelines:
|
||||
# -------------------------------------------------------------------------
|
||||
# Once features/fixes are integrated in dev, a PR from dev to stg
|
||||
# promotes the code to staging for final validation.
|
||||
# Note: Code quality checks (lint, typecheck, unit-tests) run in the
|
||||
# default pipeline on every push. This PR pipeline validates branch
|
||||
# routing and performs AI code review only.
|
||||
dev:
|
||||
- step:
|
||||
name: "Gate: dev → stg"
|
||||
@@ -291,10 +293,6 @@ pipelines:
|
||||
[ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
|
||||
done
|
||||
echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
|
||||
- parallel:
|
||||
- step: *lint
|
||||
- step: *typecheck
|
||||
- step: *unit-tests
|
||||
- step: *ai-code-review
|
||||
|
||||
# -------------------------------------------------------------------------
|
||||
@@ -302,6 +300,9 @@ pipelines:
|
||||
# -------------------------------------------------------------------------
|
||||
# Final promotion: staging to main. After this merges, the code is
|
||||
# ready for a production release via the custom release-prod pipeline.
|
||||
# Note: Code quality checks (lint, typecheck, unit-tests) run in the
|
||||
# default pipeline on every push. This PR pipeline validates branch
|
||||
# routing and performs AI code review only.
|
||||
stg:
|
||||
- step:
|
||||
name: "Gate: stg → main"
|
||||
@@ -317,10 +318,6 @@ pipelines:
|
||||
[ "${BITBUCKET_PR_DESTINATION_BRANCH}" = "$t" ] && exit 0
|
||||
done
|
||||
echo "BLOCKED: target must be one of: ${ALLOWED}"; exit 1
|
||||
- parallel:
|
||||
- step: *lint
|
||||
- step: *typecheck
|
||||
- step: *unit-tests
|
||||
- step: *ai-code-review
|
||||
|
||||
|
||||
@@ -441,6 +438,15 @@ pipelines:
|
||||
exit 1
|
||||
fi
|
||||
- export RELEASE_TAG="$(cat release_tag.txt)"
|
||||
# Validate tag format before deployment — reject corrupted/empty tags.
|
||||
# Regex: v followed by three version numbers (no leading zeros).
|
||||
# Escaped dots: \. matches literal dots, not any character.
|
||||
- |
|
||||
if ! [[ "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
|
||||
echo "BLOCKED: invalid release tag format: $RELEASE_TAG"
|
||||
echo "Expected format: v#.#.# (e.g., v1.2.3, no leading zeros)"
|
||||
exit 1
|
||||
fi
|
||||
- echo "Deploying ${RELEASE_TAG}"
|
||||
|
||||
# DEPLOY_COMMAND is a repository variable configured in
|
||||
|
||||
Reference in New Issue
Block a user