old-docker-actions/release-cleanup
2
0
Fork 0
Code Pull Requests Actions Releases 4 Activity

docs(release-cleanup): 於 cleanupOrphanTags 註記 TOCTOU 殘餘競態

Browse Source 
明確文件化 release 與 tag 兩次獨立 API 呼叫間的時序競態(已知限制),
說明現行緩解與為何屬排程任務可接受範圍。僅註解變更。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffery
2026-06-26 14:05:09 +08:00
co-authored by Claude Opus 4.8
parent e6bd11a019
commit 3586ab3803
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/tags.js
+4 -1
View File
@@ -42,7 +42,10 @@ export function categorizeTags(tags, releaseTagNames) {
export async function cleanupOrphanTags(client, config) { export async function cleanupOrphanTags(client, config) {
section('刪除未指定 release 的 tag') section('刪除未指定 release 的 tag')
// 重新取得 release 清單,得到刪除舊版本後仍指定 tag 的成品 // 重新取得 release 清單,得到刪除舊版本後仍指定 tag 的成品。
// 已知限制(TOCTOU):release 與 tag 為兩次獨立 API 呼叫,Gitea 無交易機制;
// 若兩次呼叫之間有新 release 關聯到某 tag,該 tag 仍可能基於過時快照被誤判為孤立。
// 此為排程清理任務可接受的殘餘競態(下次執行會自我修正),完整原子性留待人工評估。
const currentReleases = await client.fetchAllPages(config.releaseApiUrl) const currentReleases = await client.fetchAllPages(config.releaseApiUrl)
const releaseTagNames = currentReleases.map((release) => release.tag_name) const releaseTagNames = currentReleases.map((release) => release.tag_name)