Repository navigation
ci(release): publish every release automatically, with no stored token - #11
Merged
Merged
Conversation
release-please now runs on every push to main, so merging the release pull request creates the tag and the release. A release created with GITHUB_TOKEN does not trigger the release event, so release-please starts release.yml for the new tag with workflow_dispatch, which GITHUB_TOKEN may trigger. release.yml accepts the tag as an input as well as the release event. Registries use trusted publishing, so no publishing token is stored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Codex review ( 💡 Code reviewReviewed commit: No blocking findings in commit Verdict: APPROVE |
arosasg
added a commit
that referenced
this pull request
Oct 29, 2026
…om-repo Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 1.0.0 release (2026-10-29) needed manual steps: release-please ran only by hand, and a GitHub release created with the default
GITHUB_TOKENdoes not trigger therelease: publishedevent, sorelease.yml(the publish workflow) did not start. Alex asked that every future release publish straight from the repository.Solution
main(and by hand), so merging its release pull request cuts the release.release.ymlfor the new tag withgh workflow run, whichGITHUB_TOKENis allowed to trigger (actions: write). No personal access token is stored.taginput (workflow_dispatch) next to the release event, and checks out that tag.Verification
actionlinton the changed workflows: no findings.release.ymland its environment, which aworkflow_dispatchrun keeps (the OIDC claims carry the same workflow file and environment).🤖 Generated with Claude Code