Automatic release creation can ignore channel rules when the referenced step is not the same as the channel version rules

[patrick-smergut-octopus]

Severity

Impacting one customer, potential to impact others

Version

2024.2.4636

Latest Version

None

What happened?

If the step set in ARC doesn't match the step in the associated channel's version rules, ARC can create a release that ignores the associated channel rules, and the wrong package versions may be associated with that release.

In this configuration, if a package is pushed through with a pre-release tag (e.g. Package.1.0.0-dev.zip) a release will be automatically created with that package version, regardless of the channel being used in ARC prohibits it (using ^$ as the version rule pre-release tag).

Expected result: No release should be created because ARC should ignore pre-release tags, but also the channel's versioning rules should prevent package versions with pre-release tags from being created in a release.

Actual result: A new release is created with the pre-release version of the packages.

Reproduction

Create a project with the following:

• Two Deploy a Package steps that deploy the same package, with each step set to only 'Prod' environment or 'Dev' environment
• A prod channel that uses a prod-only env lifecycle, version rules based on the Deploy a Package only to 'Prod' step, and excludes pre-release tags with ^$
• A dev channel that uses a dev-only env lifecycle, version rules based on the 'Deploy a Package' only to 'Dev' step, and pre-release tag matching dev

Configure Automatic Release Creation:

• Use the Deploy a Package only to Dev step
• Set the channel to the prod-only one

Upload a new version of the package associated with the Deploy a Package step that has a pre-release tag of dev (e.g. Package.1.0.0-dev.zip) and see that a release is created with that package version, and the channel rules are ignored (a package version with dev pre-release is added to the release).

Error and Stacktrace

No response

More Information

Internal link to release created by repro

First reported here [internal]

Workaround

Use the same step in ARC settings as the associated Channel versioning rule, for example:

• ARC configuration - Referenced Step: Deploy my custom script, Referenced Channel: Production only
• Production only channel version rule - Pre-release tag: ^$, Referenced Step: Deploy my custom script