release(runway): cherry-pick feat(ci): derive orchestrator version from release branch - #45224
Merged
sleepytanya merged 1 commit intoAug 5, 2026
Merged
Conversation
…om release branch (#45101) ## **Description** The Runway orchestrator (`runway-extension-release-and-submit.yml`) took a required `version` input that had to equal the `release/X.Y.Z` branch semver. It therefore carried no information the branch did not already provide, added a way for the two to disagree, and Runway does not send it — the first real dispatch would have failed on a missing required input. This removes the input and derives the version from the branch with `.github/scripts/extract-semver.sh`, the same script `publish-release-from-release-head.yml` uses, so the orchestrator and the publish workflow it calls cannot disagree about which version is being released. Two follow-on changes fall out of that: - `execute_store_phases` now defaults to `true`. The `false` default was a bootstrap safety measure from #44017 for merging the orchestrator before Runway was wired; leaving it would mean a Runway dispatch that omits the input validates everything and then does nothing. `false` is still available for a validation-only run. - `concurrency` is keyed on `github.ref` instead of `inputs.version`, matching `publish-release-from-release-head.yml`. With the input gone the branch is the only version source, and one in-flight run per release branch is the same guarantee as one per version. `release_sha` is unchanged and stays optional: it is an integrity check against the Runway record, not a version source. The `skip_*` break-glass inputs are unchanged. ### Also here: the AMO reviewer artifact publish has never worked `Publish AMO reviewer artifacts to S3` has reported `✅ Published` in every release since it merged (#43785) while uploading nothing. `prd-va-mmc-extension-submission-amo-reviewer-source` currently holds **zero objects**. Two independent causes, both fixed here: - **The step could never report failure.** It is `continue-on-error: true`, and the summary branched on `steps.amo-reviewer-s3.conclusion`, which is always `success` once `continue-on-error` is applied. The `⏭ Skipped` and `❌ Failed` branches were unreachable and the `exit 1` guard never fired. All three references now use `.outcome`. - **`apt-get install -y mtree` installs a package that does not exist on Ubuntu.** `/usr/bin/mtree` comes from `mtree-netbsd`, which is the NetBSD flavour `compare_builds.sh` needs for `mtree -c -k sha256digest -p`. Verified in `ubuntu:24.04`: it installs from the default repos, and the exact invocations return 0 on identical trees and non-zero on a modified file. The run history behind this: v13.39.0 through v13.41.0 died instantly at "Prepare all required actions" because `aws-actions/configure-aws-credentials` was not on the org actions allowlist — 0 seconds, nothing packaged, nothing uploaded. That allowlist entry exists now, so v13.42.0 got one step further and failed with `E: Unable to locate package mtree` (exit 100), which skipped the AWS credential and upload steps. The Firefox bundle script push in the same job is unaffected and has succeeded in all of those releases. - **The job had no time budget for what this step does.** `timeout-minutes` was 45 while the publish job already spends ~9 minutes on Sentry, attestations and the release itself, and packaging adds two full cold production MV2 builds (main and Flask) for the reproducible-build comparison. Raised to 90. The upload leg itself was reviewed against the platform side and matches: the `amo-reviewer-publisher` trust policy pins `sub=repo:MetaMask/metamask-extension:environment:release-branch`, `ref` under `refs/heads/release/*` and `job_workflow_ref` to this workflow file, all of which this job satisfies; the role's `s3:PutObject` grant on `reviewer-source/*` covers the keys the script writes; the bucket is `AES256` so no KMS grant is needed; and the object names match what the amo-submission Lambda reads. Note for future refactors: moving this step into a different workflow file would break the `job_workflow_ref` condition, and the role has no `ListBucket`/`GetObject`, so an S3 pre-flight check is not possible with these permissions. Still unproven: because packaging has never completed in CI, the reproducible-build comparison in `compare_builds.sh` has never executed there. The build command it runs is character-identical to this workflow's own (`yarn webpack:lavamoat:build:mv2 [--type flask] --zip --env production`), `TZ=UTC` is set on both sides, and the comparison keys on content digests only, so checkout-vs-archive mtime differences are irrelevant. The next release is the first real test. ## **Changelog** CHANGELOG entry: null ## **Related issues** Fixes: [INFRA-3674](https://consensyssoftware.atlassian.net/browse/INFRA-3674) ## **Manual testing steps** CI-only change; no extension build or UI is involved. Orchestrator version derivation, verifiable by dispatch: 1. On a `release/X.Y.Z` branch, dispatch **Runway extension release and store submit** with `execute_store_phases=false` (validation-only, cuts nothing and uploads nothing). 2. Confirm Phase 0's summary reports `Version: X.Y.Z` matching the branch, with no `version` input in the dispatch form. 3. Dispatch the same workflow from a non-release branch and confirm Phase 0 fails at **Validate branch ref**. 4. A human dispatch fails at Phase 0's Runway sender check, so end-to-end verification of the default `execute_store_phases=true` path requires a Runway-initiated dispatch on a real release branch. AMO reviewer artifacts, only exercisable by a real release: 5. After the next production release, open the **Publish release** job summary. The `AMO reviewer S3 (PRD)` row can no longer be a false `✅ Published` — if packaging or upload fails it now reads `❌ Failed` and the job goes red. 6. Confirm four objects appear under `s3://prd-va-mmc-extension-submission-amo-reviewer-source/reviewer-source/X.Y.Z/` (production and Flask source zips plus their approval notes). 7. If the job does go red at that step, re-run failed jobs rather than re-dispatching: the tag and release creation ahead of it are idempotent and skip when already correct. <!-- ## **Screenshots/Recordings** ### **Before** ### **After** --> ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [ ] I've included tests if applicable - [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots. Made with [Cursor](https://cursor.com) [INFRA-3674]: https://consensyssoftware.atlassian.net/browse/INFRA-3674?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: Cursor <cursoragent@cursor.com>
runway-github
Bot
requested review from
a team,
HowardBraham and
itsyoboieltr
as code owners
August 5, 2026 10:11
Contributor
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
|
Contributor
Builds ready [e195261] [reused from f576b8f]
⚡ Performance Benchmarks (Total: 🟢 9 pass · 🟡 9 warn · 🔴 4 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
sleepytanya
approved these changes
Aug 5, 2026
metamaskbot
added
the
release-13.43.0
Contributor
|
No release label on PR. Adding release label release-13.43.0 on PR, as PR was cherry-picked in branch 13.43.0. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The Runway orchestrator (
runway-extension-release-and-submit.yml) tooka required
versioninput that had to equal therelease/X.Y.Zbranchsemver. It therefore carried no information the branch did not already
provide, added a way for the two to disagree, and Runway does not send
it — the first real dispatch would have failed on a missing required
input.
This removes the input and derives the version from the branch with
.github/scripts/extract-semver.sh, the same scriptpublish-release-from-release-head.ymluses, so the orchestrator andthe publish workflow it calls cannot disagree about which version is
being released.
Two follow-on changes fall out of that:
execute_store_phasesnow defaults totrue. Thefalsedefault wasa bootstrap safety measure from feat(ci): add Runway orchestrator starter and store submission CODEOWNERS #44017 for merging the orchestrator
before Runway was wired; leaving it would mean a Runway dispatch that
omits the input validates everything and then does nothing.
falseisstill available for a validation-only run.
concurrencyis keyed ongithub.refinstead ofinputs.version,matching
publish-release-from-release-head.yml. With the input gonethe branch is the only version source, and one in-flight run per release
branch is the same guarantee as one per version.
release_shais unchanged and stays optional: it is an integrity checkagainst the Runway record, not a version source. The
skip_*break-glass inputs are unchanged.
Also here: the AMO reviewer artifact publish has never worked
Publish AMO reviewer artifacts to S3has reported✅ Publishedinevery release since it merged (#43785) while uploading nothing.
prd-va-mmc-extension-submission-amo-reviewer-sourcecurrently holdszero objects. Two independent causes, both fixed here:
continue-on-error: true, and the summary branched onsteps.amo-reviewer-s3.conclusion,which is always
successoncecontinue-on-erroris applied. The⏭ Skippedand❌ Failedbranches were unreachable and theexit 1guardnever fired. All three references now use
.outcome.apt-get install -y mtreeinstalls a package that does not exist onUbuntu.
/usr/bin/mtreecomes frommtree-netbsd, which is theNetBSD flavour
compare_builds.shneeds formtree -c -k sha256digest -p. Verified inubuntu:24.04: it installs from the default repos, andthe exact invocations return 0 on identical trees and non-zero on a
modified file.
The run history behind this: v13.39.0 through v13.41.0 died instantly at
"Prepare all required actions" because
aws-actions/configure-aws-credentialswas not on the org actionsallowlist — 0 seconds, nothing packaged, nothing uploaded. That
allowlist entry exists now, so v13.42.0 got one step further and failed
with
E: Unable to locate package mtree(exit 100), which skipped theAWS credential and upload steps. The Firefox bundle script push in the
same job is unaffected and has succeeded in all of those releases.
timeout-minuteswas 45 while the publish job already spends ~9 minuteson Sentry, attestations and the release itself, and packaging adds two
full cold production MV2 builds (main and Flask) for the
reproducible-build comparison. Raised to 90.
The upload leg itself was reviewed against the platform side and
matches: the
amo-reviewer-publishertrust policy pinssub=repo:MetaMask/metamask-extension:environment:release-branch,refunder
refs/heads/release/*andjob_workflow_refto this workflowfile, all of which this job satisfies; the role's
s3:PutObjectgranton
reviewer-source/*covers the keys the script writes; the bucket isAES256so no KMS grant is needed; and the object names match what theamo-submission Lambda reads. Note for future refactors: moving this step
into a different workflow file would break the
job_workflow_refcondition, and the role has no
ListBucket/GetObject, so an S3pre-flight check is not possible with these permissions.
Still unproven: because packaging has never completed in CI, the
reproducible-build comparison in
compare_builds.shhas never executedthere. The build command it runs is character-identical to this
workflow's own (
yarn webpack:lavamoat:build:mv2 [--type flask] --zip --env production),TZ=UTCis set on both sides, and the comparisonkeys on content digests only, so checkout-vs-archive mtime differences
are irrelevant. The next release is the first real test.
Changelog
CHANGELOG entry: null
Related issues
Fixes:
INFRA-3674
Manual testing steps
CI-only change; no extension build or UI is involved.
Orchestrator version derivation, verifiable by dispatch:
release/X.Y.Zbranch, dispatch Runway extension release andstore submit with
execute_store_phases=false(validation-only, cutsnothing and uploads nothing).
Version: X.Y.Zmatching thebranch, with no
versioninput in the dispatch form.Phase 0 fails at Validate branch ref.
end-to-end verification of the default
execute_store_phases=truepathrequires a Runway-initiated dispatch on a real release branch.
AMO reviewer artifacts, only exercisable by a real release:
summary. The
AMO reviewer S3 (PRD)row can no longer be a false✅ Published— if packaging or upload fails it now reads❌ Failedandthe job goes red.
s3://prd-va-mmc-extension-submission-amo-reviewer-source/reviewer-source/X.Y.Z/(production and Flask source zips plus their approval notes).
re-dispatching: the tag and release creation ahead of it are idempotent
and skip when already correct.
Pre-merge author checklist
Docs and MetaMask
Extension Coding
Standards.
if applicable
guidelines).
Not required for external contributors.
Pre-merge reviewer checklist
app, test code being changed).
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
Made with Cursor
Co-authored-by: Cursor cursoragent@cursor.com 695f92f