From 021110b451e5372b1f7cf47cb3339c411e3ab741 Mon Sep 17 00:00:00 2001
From: Feng Ruohang <rh@vonng.com>
Date: Wed, 5 Aug 2026 01:06:12 +0800
Subject: [PATCH] ci: make the lint, getdeps, and release gates fail honestly

Three gate-correctness fixes:

- lint: `command typos && typos ./ || echo skipping` ran typos twice (POSIX
  `command` executes it) and, via `&& ... || echo`, turned a real typo finding
  (nonzero exit) into the "not installed" message with exit 0 - so spelling
  issues could never fail the gate. Use `command -v` to test presence and run
  typos once, letting its findings surface.

- getdeps: `curl -sSfL ... | sh` took the pipeline's exit from sh, and make's
  /bin/sh has no pipefail, so a failed or partial download of the golangci-lint
  installer was reported as success and a truncated script could run. Download
  to a temp file under `set -e` (with a trap to clean it up) and execute that,
  so a curl failure aborts the target. Verified: a 404 now exits nonzero
  instead of silently continuing.

- release: workflow_dispatch checked out github.ref (the branch it ran from)
  while naming artifacts after the input tag, so a release could be built from
  one ref and published under another. Pin checkout to the requested tag.

Not addressed here: the server's release container image is still only built
by the publish-time docker-release workflow, never in CI (MC covers this in
its test-release). Flagged for a separate decision.

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/release.yml | 5 +++++
 Makefile                      | 8 ++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 259f2dc91..1902768a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # Build the code at the tag being released, not whatever branch the
+          # dispatch ran from. On a tag push this is the tag ref already; on
+          # workflow_dispatch it pins the checkout to the requested tag so the
+          # artifacts cannot be built from one ref and published under another.
+          ref: ${{ github.event.inputs.tag || github.ref }}
 
       - name: Set up Go
         uses: actions/setup-go@v5
diff --git a/Makefile b/Makefile
index 2573608e8..45017ff8d 100644
--- a/Makefile
+++ b/Makefile
@@ -25,8 +25,12 @@ help: ## print this help
 getdeps: ## fetch necessary dependencies
 	@mkdir -p ${GOPATH}/bin
 	@if [ ! -x "$(GOLANGCI)" ]; then \
+		set -e; \
 		echo "Installing golangci-lint $(GOLANGCI_VERSION)"; \
-		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh | sh -s -- -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
+		script=$$(mktemp); \
+		trap 'rm -f "$$script"' EXIT; \
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh -o "$$script"; \
+		sh "$$script" -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
 	fi
 
 crosscompile: ## cross compile minio
@@ -53,7 +57,7 @@ check-gen: ## check for updated autogenerated files
 lint: getdeps ## runs golangci-lint suite of linters
 	@echo "Running $@ check"
 	@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml
-	@command typos && typos ./ || echo "typos binary is not found.. skipping.."
+	@if command -v typos >/dev/null 2>&1; then typos ./; else echo "typos binary is not found.. skipping.."; fi
 
 lint-fix: getdeps ## runs golangci-lint suite of linters with automatic fixes
 	@echo "Running $@ check"