Skip to content

feat(release): concurrency lock to prevent racing ferrflow release runs#517

Open
BryanFRD wants to merge 1 commit into
feat/quick-wins-perf-securityfrom
feat/release-concurrency-lock
Open

feat(release): concurrency lock to prevent racing ferrflow release runs#517
BryanFRD wants to merge 1 commit into
feat/quick-wins-perf-securityfrom
feat/release-concurrency-lock

Conversation

@BryanFRD
Copy link
Copy Markdown
Contributor

Stacked on #516. First half of #514 (the lock); checkpoint/resume stays open as a heavier follow-up.

Problem

Two concurrent `ferrflow release` invocations on the same repo (manually-triggered racing the cron-driven `auto-release` workflow, or two CI runners on the same commit) competed on git refs. Observed symptoms: non-fast-forward rejects, half-pushed tag sets, draft releases created twice.

Fix

New `src/monorepo/run/lock.rs`: RAII lock guard backed by `.git/ferrflow.lock` created via O_CREAT|O_EXCL — atomic, released on drop including panic unwind. Acquired at the top of `run_release_logic` for non-dry-run only. Read-only commands (`check`, `status`, `version`, `tag`) are unaffected.

Stale lock recovery

A lockfile older than 30 min is treated as orphaned (process crashed without releasing) and taken over with a warning. Beyond that, the `acquire_force` path exists for an eventual `--force-unlock` CLI flag (kept private for now).

Test plan

  • 6 unit tests: clean acquire, drop removes, busy second-acquire fails, force-unlock takes over, missing .git errors out, lockfile starts with PID
  • 521 lib + 635 bin tests pass overall
  • `cargo clippy --features cli -- -D warnings` clean
  • Manual: trigger two `ferrflow release` in parallel against the same repo — second exits with "another release is already running" error code GIT_LOCKED (2011)

First half of #514. Closes the lock concern; the checkpoint/resume
piece stays open (heavier design, separate PR).

## Problem

Two concurrent ferrflow release invocations on the same repo (typical
scenario: manually-triggered release racing the cron-driven
auto-release workflow, or two CI runners on the same commit) competed
on git refs. Observed symptoms: non-fast-forward rejects, half-pushed
tag sets, draft releases created twice.

## Fix

New src/monorepo/run/lock.rs: RAII lock guard backed by
.git/ferrflow.lock created via O_CREAT|O_EXCL. Atomic. Released on
drop, including panic unwind.

Acquired at the top of run_release_logic for non-dry-run only.
Read-only commands (check, status, version, tag) are not affected.

## Stale lock recovery

A lockfile older than STALE_LOCK_TTL (30 min, longer than any realistic
release) is treated as orphaned (process crashed without releasing)
and taken over with a warning. Beyond TTL the user can also
force-unlock manually by deleting the file; future PR may expose this
via --force-unlock CLI flag.

## Tests

- 6 unit tests in src/monorepo/run/lock.rs::tests:
  - acquire on clean repo succeeds
  - drop removes lockfile
  - second acquire fails while first held
  - force unlock takes over active lock
  - missing .git dir errors out cleanly
  - lockfile content starts with PID
- 521 lib + 635 bin tests pass overall
- cargo clippy -D warnings clean

## Out of scope

The checkpoint/resume mechanism from #514 (write release-state.json at
each step, resume if interrupted) is deferred — needs separate design
review around atomic write + invalidation rules. Issue stays open.
Copilot AI review requested due to automatic review settings May 24, 2026 12:31
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants