Block release if checks are failing

Author: divolgin

.github/workflows/release.yaml

@@ -8,7 +8,9 @@ on:
       - main
 
 permissions:
+  checks: read
   contents: write
+  statuses: read
 
 jobs:
   generate-tag:
@@ -29,6 +31,72 @@ jobs:
           git tag "$GIT_TAG"
           git push origin "$GIT_TAG"
 
+  validate-production-tag:
+    name: Validate production tag checks
+    runs-on: ubuntu-latest
+    needs: [generate-tag]
+    permissions:
+      checks: read
+      contents: read
+      statuses: read
+    steps:
+      - name: Fail if the tagged commit has failing or pending checks
+        if: github.ref_type == 'tag' && !contains(needs.generate-tag.outputs.tag, '-')
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const failingConclusions = new Set([
+              "action_required",
+              "cancelled",
+              "failure",
+              "stale",
+              "startup_failure",
+              "timed_out",
+            ]);
+
+            const checkRuns = await github.paginate(
+              github.rest.checks.listForRef,
+              {
+                ...context.repo,
+                ref: context.sha,
+                filter: "latest",
+                per_page: 100,
+              },
+            );
+            const currentRunPath = `/actions/runs/${context.runId}/`;
+            const blockingChecks = checkRuns.filter((check) => {
+              // Do not block the release on jobs from this workflow run.
+              if (check.details_url?.includes(currentRunPath)) {
+                return false;
+              }
+              return check.status !== "completed" ||
+                failingConclusions.has(check.conclusion);
+            });
+
+            const { data: combinedStatus } =
+              await github.rest.repos.getCombinedStatusForRef({
+                ...context.repo,
+                ref: context.sha,
+              });
+            const blockingStatuses = combinedStatus.statuses.filter(
+              (status) => status.state !== "success",
+            );
+
+            if (blockingChecks.length || blockingStatuses.length) {
+              const blockers = [
+                ...blockingChecks.map(
+                  (check) =>
+                    `check run: ${check.name} (${check.conclusion ?? check.status})`,
+                ),
+                ...blockingStatuses.map(
+                  (status) => `commit status: ${status.context} (${status.state})`,
+                ),
+              ];
+              core.setFailed(
+                `Production release blocked because ${context.sha} has failing or pending checks:\n${blockers.join("\n")}`,
+              );
+            }
+
   build-melange-packages:
     needs: [generate-tag]
     if: contains(needs.generate-tag.outputs.tag, '-')
@@ -48,7 +116,7 @@ jobs:
           arch: ${{ matrix.runner.arch }}
 
   build-securebuild:
-    needs: [generate-tag]
+    needs: [generate-tag, validate-production-tag]
     if: github.ref_type == 'tag' && !contains(needs.generate-tag.outputs.tag, '-')
     uses: ./.github/workflows/publish-securebuild.yml
     with:
@@ -205,7 +273,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     if: github.ref_type != 'branch'
-    needs: [generate-tag, build-web]
+    needs: [generate-tag, validate-production-tag, build-web]
     steps:
     - name: Checkout
       uses: actions/checkout@v7
@@ -384,7 +452,7 @@ jobs:
 
   generate-kots-release-notes-pr:
     runs-on: ubuntu-latest
-    needs: [generate-tag]
+    needs: [generate-tag, validate-production-tag]
     if: github.ref_type != 'branch'
     steps:
     - name: Checkout