Skip to content

fix(ci): enable package publish on tags #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jess Sullivan (Jesssullivan) merged 1 commit into from
Apr 28, 2026
Merged

fix(ci): enable package publish on tags #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,24 @@ name: CI
on:
push:
branches: [main]
tags: ['v*']
pull_request:
branches: [main]
workflow_dispatch:
inputs:
publish:
description: "Publish the selected ref after validation"
required: false
type: boolean
default: false
permissions:
actions: read
contents: read
packages: read
packages: write
id-token: write
jobs:
package:
uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@21e0093a7586931ee69d716387e00556c6da7738
uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@53f03268571577260546e0bba850664f8cdaf441
with:
runner_mode: shared
shared_runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}
Expand All @@ -29,5 +37,6 @@ jobs:
package_dir: ./bazel-bin/pkg
npm_access: public
github_package_name: "@tummycrypt/tinyland-security"
Comment on lines 38 to 39

@greptile-apps greptile-apps Bot Apr 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 dry_run is always true on tag pushes

The expression !(github.event_name == 'workflow_dispatch' && inputs.publish == true) evaluates to true on every push event (including v* tag pushes), so the reusable workflow receives both dry_run: true and publish_on_tag: true simultaneously on a tag trigger. Whether a publish actually occurs depends entirely on whether the reusable workflow at 53f0326 lets publish_on_tag override a caller-supplied dry_run: true — that contract isn't visible here. If dry_run takes precedence, tags will silently produce a dry run instead of a real publish, negating the purpose of this PR.

To make the intent explicit and remove the ambiguity, include the tag-push case in the dry_run expression:

Suggested change
npm_access: public
github_package_name: "@tummycrypt/tinyland-security"
dry_run: ${{ !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) && !(github.event_name == 'workflow_dispatch' && inputs.publish == true) }}
publish_on_tag: true

dry_run: true
dry_run: ${{ !(github.event_name == 'workflow_dispatch' && inputs.publish == true) }}
publish_on_tag: true
secrets: inherit
Loading