From c6c640c6a65e1df380784bc99377a08095444b81 Mon Sep 17 00:00:00 2001
From: Joshua Temple <joshua.temple@stablekernel.com>
Date: Sat, 27 Jun 2026 08:30:31 -0400
Subject: [PATCH] fix(fleet): repin rewrites stale dryrun refs, not just rc
 refs

The repin's in-repo ref rewrite only matched vX.Y.Z-rc.N, so a hand-written setup-cli pin left pointing at a vX.Y.Z-dryrun.N tag (from a dry-run validation repin) was never updated to the current rc. After the dryrun tags were pruned, primary and rollback-dispatch failed at Set up job (Unable to resolve action stablekernel/cascade@v0.6.0-dryrun.2) and the first live nightly fleet went red. Broaden the grep and sed to match -(rc|dryrun). so any stale prerelease pin self-heals to the rc on the next repin. Part of #373.

Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
---
 .github/workflows/fleet-e2e.yaml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml
index 4ff3ac6..441838d 100644
--- a/.github/workflows/fleet-e2e.yaml
+++ b/.github/workflows/fleet-e2e.yaml
@@ -353,7 +353,7 @@ jobs:
         run: |
           set -euo pipefail
           # The full roster of 10 example repos. Repinning means: set manifest
-          # cli_version to the rc, replace any other in-repo rc-version refs,
+          # cli_version to the rc, replace any other in-repo prerelease refs (rc/dryrun),
           # regenerate the workflows with the rc binary, then commit + push only
           # if something changed. This preserves every hand-written suite feature:
           # regeneration only rewrites the generated workflows, and we touch
@@ -379,14 +379,15 @@ jobs:
             #     repos is tracked separately.
             sed -i -E '/^[[:space:]]*cli_version_sha:[[:space:]]*/d' "$manifest"
 
-            # 2. Replace any other in-repo rc-version refs (e.g. an explicit
-            #    setup-cli@v..-rc.. pin a suite hand-wrote) with the rc. Scope
+            # 2. Replace any other in-repo prerelease refs (rc OR dryrun, e.g. an
+            #    explicit setup-cli@v..-rc.. or a stale @v..-dryrun.. pin a suite
+            #    hand-wrote, which a prior dry-run repin may have left) with the rc. Scope
             #    to tracked text files; the regen below rewrites generated
             #    workflows, this catches anything outside them.
             while IFS= read -r f; do
               [ -f "$f" ] || continue
-              sed -i -E "s|v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+|${RC_VERSION}|g" "$f"
-            done < <(grep -rlE "v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+" . --include='*.yaml' --include='*.yml' 2>/dev/null || true)
+              sed -i -E "s#v[0-9]+\.[0-9]+\.[0-9]+-(rc|dryrun)\.[0-9]+#${RC_VERSION}#g" "$f"
+            done < <(grep -rlE "v[0-9]+\.[0-9]+\.[0-9]+-(rc|dryrun)\.[0-9]+" . --include='*.yaml' --include='*.yml' 2>/dev/null || true)
 
             # 3. Regenerate the workflows with the rc binary. This rewrites the
             #    generated setup-cli refs to the rc and nothing hand-written.