Handle race condition on PR merged

[MarcoIeni]

Motivations

Asked here.

You can run into this situation:

1. Person A does @bors r+ on PR 20
2. Person B does @bors r+ on PR 21
3. PR 20 is merged into master
4. Person A sees PR 20 is merged and does @bors r+ on the release for PR 20, PR 22
5. PR 21 is merged into master
6. PR 22 is merged into master
7. master's workflow runs that does the publish for PR 22

This means you tag and publish with PR 21 included which will be missing from the changelog, be unreviewed by the release manager, etc.

If your PRs are merged into main with merge-commits, then the commit with the version bump only has ancestors that are strictly those intended to go into that release.

flowchart LR
  pr20(["PR 20 (fix)"])
  pr20_merge["master
  (PR 20 merge commit)"]
  pr21(["PR 21 (breaking change)"])
  pr21_merge["master
  (PR 21 merge commit)"]
  pr22(["PR 22 (release)"])
  pr22_merge["master
  (PR 22 merge commit)"]
  master --> pr20
  master --> pr20_merge
  pr20 --> pr20_merge
  master --> pr21
  pr20_merge --> pr21_merge
  pr21 --> pr21_merge
  pr20_merge --> pr22
  pr22 --> pr22_merge
  pr21_merge --> pr22_merge

The publish happens on "PR 22 merge commit" which includes too much.

Solution

Instead of releasing from main we should find a way to do git checkout "PR 22" and do the publish on that.

[MarcoIeni]

Another user has the same issue: #1412 (comment)
They also pointed out that this issue can impact semver check: a breaking change could be released without release-plz notices it.

[Pr0methean]

Publishing from the pull request head sounds like a pretty good solution, but if a minor release and a patch release were in the queue at the same time then the patch could end up temporarily rolled back.

[MarcoIeni]

Another con of the git checkout approach is that the git commit published in .cargo_vcs_info.json doesn't belong to the main branch, which is unfortunate.
Release-plz also uses this commit as a "guard rail" to determine if it's going too far in the git history

[MarcoIeni]

This is a complex problem that probably different people want to solve in different ways 😅
Can we maybe build some common utilities in release-plz so that everyone has the tool to solve it in their own way?
I'm almost done with github action output, for example: MarcoIeni/release-plz-action#129