ci: stop pushing the rolling v1 tag from release.yml#1837
Merged
Conversation
GITHUB_TOKEN can never update a ref whose diff touches .github/workflows/ (the workflows permission is not grantable to it), so the in-workflow v1 push failed on the first release after any workflow edit (v3.4.2), and because it sat upstream of the publish jobs it turned a cosmetic step into a partial publish. The rolling v1/v3 tags are pushed by the maintainer release flow instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v3.4.2 run failed its Create Release job on the final "Update stable action tags" step: GitHub rejects a
GITHUB_TOKEN-authenticated ref update whose diff modifies.github/workflows/, and theworkflowspermission cannot be granted to that token at all. The step therefore only worked on releases where no workflow file had changed since v1's last position, and because it sat upstream ofnpm-publish,vscode-publish, anddocker-lockstepin the needs graph, its failure produced a partial publish (crates.io out, npm and marketplace skipped).The step is removed with an explanatory comment; the rolling
v1/v3tags are pushed by the maintainer release flow, whose credentials carry the workflow scope. The release-workflow boundary doc's persist-credentials note is updated to match.actionlint clean, YAML parses, zizmor identical to baseline (0 new findings).