Repository navigation
🐛 fix(publish-github-release): create the release on the existing tag - #68
Merged
Merged
Conversation
GitHub checks a release target's workflow files against the default branch tip and refuses GITHUB_TOKEN, which lacks the workflows permission, once a later merge changed a workflow. simplint 0.11.0 hit this when a CI change merged while its release built. The tag already exists, so drop the target and stop if the tag is missing or points at another commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
simplint's 0.11.0 release reached PyPI, but
publish-github-releasefailed to create the GitHub Release withResource not accessible by integration (HTTP 403), even though the job's token had Contents write. 🐛 The release built from the tag's commit for about an hour, and in that time a pull request that changed workflow files merged to main. Once this merges, a release publishes no matter what merges while it builds.The Action named the tag's commit as the release target. As blinkbitcoin/shared-workflows#29 reproduces, GitHub then compares that commit's workflow files with the default branch tip and refuses a
GITHUB_TOKEN, which never holds theworkflowspermission, when they differ. The create-release API ignores the target when the tag already exists, and the Action documents itstaginput as an existing tag, so the draft is now created on the tag alone.Without a target, a missing tag would end up on the default branch tip when the draft is published. The Action therefore reads the tag's commit before creating the draft and stops with
tag <tag> must exist and point at <commit>when the tag is missing or names another commit. Callers change nothing.