Release autopilot 7.5.0 #158
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Source: https://github.com/awinogradov/code-assistants/blob/main/.github/workflows/release-publish.yml | |
| # This file is distributed to downstream repositories by an automated sync. | |
| # Edits made downstream are overwritten on the next run. | |
| # To change it, open a pull request against the source file above. | |
| # | |
| # Requires repo secrets and variables: | |
| # - `BOT_TOKEN` (secret): PAT or App installation token with `contents: write` and | |
| # `pull-requests: write`, used to read PR files and publish the release. | |
| # - `BOT_USERNAME` (variable, optional): git author login for release tags and the | |
| # GitHub Release. Defaults to `github-actions[bot]` when unset. | |
| # - `NPM_TOKEN` (secret): granular npm token, required for repositories with | |
| # npm-publishing members (lib-nodejs/lib-bun, non-private claude-plugin). | |
| # | |
| # npm auth on this workflow is token-based: GitHub does not issue OIDC tokens to | |
| # pull_request_target-triggered runs (the `id-token: write` grant below is | |
| # silently dropped — observed on run 33078980085; see | |
| # https://github.com/orgs/community/discussions/137761), so npm trusted | |
| # publishing cannot engage here. The grant stays declared so a future move of | |
| # the publish job to an OIDC-capable trigger needs no permissions change, and | |
| # the release-action's OIDC path remains available to consumers who call it | |
| # from such a trigger. First publish of a new package needs the npm scope/org | |
| # to exist and uses `NPM_TOKEN` (trusted publishing is configured on an | |
| # existing package). | |
| name: Release publish | |
| on: | |
| pull_request_target: | |
| types: [closed] | |
| paths: | |
| - "**/.release_notes/**" | |
| concurrency: | |
| group: publish-${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| publish: | |
| name: Publish release | |
| if: github.event.pull_request.merged == true | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| # Check out the default branch (github.sha), never the PR-controlled | |
| # merge_commit_sha. This job is gated on `merged == true`, so the release | |
| # commit (version + .release_notes) is already on the default branch. | |
| # Checking out a PR-derived ref would run untrusted code in this privileged | |
| # pull_request_target context (CodeQL actions/untrusted-checkout, CWE-829). | |
| - uses: actions/checkout@v7 | |
| - uses: awinogradov/code-assistants/.github/actions/release-action@main | |
| with: | |
| mode: publish | |
| bot_token: ${{ secrets.BOT_TOKEN }} | |
| bot_username: ${{ vars.BOT_USERNAME }} | |
| npm_token: ${{ secrets.NPM_TOKEN }} |