From e79d5455dc1b45d8121f1255bcac4abc71693596 Mon Sep 17 00:00:00 2001
From: mbakalarski <64490638+mbakalarski@users.noreply.github.com>
Date: Wed, 29 Jul 2026 11:57:31 +0000
Subject: [PATCH] Fix the release workflow's lint job, and let a failed release
 be re-run

The first tag this repo ever pushed, v0.0.22, never published: CI-with-BnP
failed at `lint` before hatch checked a single file, so `build` and `push`
were skipped.

    Environment `hatch-static-analysis` is incompatible: module
    'virtualenv.discovery.builtin' has no attribute 'propose_interpreters'

hatch 1.16.2 requires `virtualenv>=20.26.6` with no upper bound, so pipx
installs virtualenv 21.x, where that API is gone. It only bites when hatch has
to discover an interpreter other than its own -- on the runner pipx installs
hatch under 3.12 while setup-python puts 3.13 on PATH -- which is why
`unit-test` passed and `lint` did not.

ci.yaml has carried `pipx inject hatch "virtualenv<21"` since April for exactly
this. ci-with-bnp.yaml never got it, and until v0.0.22 it had never run.

Fix it at the source instead of copying the workaround: hatch 1.17.0 raised its
own floor to `virtualenv>=21`, so bump HATCH_VERSION to 1.17.1 in both
workflows and drop the pin. Verified locally against a reproduction of the
runner's interpreter mismatch: `hatch fmt` and `hatch test --all --randomize`
both pass. Note 1.17 deprecates `hatch fmt` in favour of `hatch check`; it
still works, and moving is a separate change.

Also add `workflow_dispatch` so a release whose publish leg fails can be re-run
without moving the tag, guarded by a job that refuses a ref that is not a tag.
The `push` job already rejects one, but only after the arm64 build has run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci-with-bnp.yaml | 20 +++++++++++++++++++-
 .github/workflows/ci.yaml          |  3 +--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-with-bnp.yaml b/.github/workflows/ci-with-bnp.yaml
index 29002ba..75566e7 100644
--- a/.github/workflows/ci-with-bnp.yaml
+++ b/.github/workflows/ci-with-bnp.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags:
       - "v*"
+  # Re-run a release whose publish leg failed without moving the tag. Select
+  # the tag as the ref when dispatching; the guard job below rejects a branch.
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -11,15 +14,29 @@ permissions:
 
 env:
   PYTHON_VERSION: "3.13"
-  HATCH_VERSION: "1.16.2"
+  HATCH_VERSION: "1.17.1"
   DOCKER_BUILDX_VERSION: "v0.30.1"
   XP_CHANNEL: stable
   XPKG: ghcr.io/${{ github.repository }}
   UP_XPKG: xpkg.upbound.io/netclab/function-eapi
 
 jobs:
+  # The tag is the version this workflow publishes, so a dispatch against a
+  # branch has nothing to release. `push` catches that today, but only after
+  # the arm64 build has already run -- fail here instead.
+  guard:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Refuse a ref that is not a tag
+        if: github.ref_type != 'tag'
+        run: |
+          echo "::error::${{ github.ref_name }} is a ${{ github.ref_type }}, not a tag." \
+               "Dispatch this workflow against a tag."
+          exit 1
+
   lint:
     runs-on: ubuntu-24.04
+    needs: guard
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -32,6 +49,7 @@ jobs:
 
   unit-test:
     runs-on: ubuntu-24.04
+    needs: guard
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d664a66..72175be 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,7 +16,7 @@ permissions:
 
 env:
   PYTHON_VERSION: "3.13"
-  HATCH_VERSION: "1.16.2"
+  HATCH_VERSION: "1.17.1"
   DOCKER_BUILDX_VERSION: "v0.30.1"
   XP_CHANNEL: stable
   XPKG: ghcr.io/${{ github.repository }}
@@ -31,7 +31,6 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Install Hatch
         run: pipx install hatch==${{ env.HATCH_VERSION }}
-      - run: pipx inject hatch "virtualenv<21" --force
       - name: Lint
         run: hatch fmt