From 257b159486ae857ccc53f6f4ec37b16b423ab833 Mon Sep 17 00:00:00 2001 From: Joel Hawksley Date: Mon, 24 Aug 2026 13:39:25 -0600 Subject: [PATCH] Fix publish-release workflow trigger and push auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow gate was: if: startsWith(github.event.head_commit.message, 'release ') But when a release PR is merged via the GitHub UI (as was done for #2697 → main), the merge commit message is: Merge pull request #2697 from ViewComponent/release-4-14-0 Release 4.14.0 That does not start with 'release ' (lowercase), so the workflow never ran and script/publish did not tag or publish 4.14.0. Also, the checkout used persist-credentials: false, so even if the gate had passed, script/publish's 'git push origin $tag' and 'git push origin gh-pages --force' would fail to authenticate — the same class of bug we hit in the release workflow. - Broaden the gate to also match the merge-commit body ('Release ') and add workflow_dispatch so publish can be re-triggered manually when a release lands but the gate was missed. - Set persist-credentials: true so tag and gh-pages pushes work. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 217f0a0d-a9f2-4607-9643-5fcb3e34f20f --- .github/workflows/publish-release.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 927215c8a..9c3a4e9b6 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -4,6 +4,7 @@ on: push: branches: - main + workflow_dispatch: permissions: contents: read @@ -16,14 +17,21 @@ jobs: permissions: contents: write pull-requests: read - # Only run if this is a release commit (created by script/release) - if: startsWith(github.event.head_commit.message, 'release ') + # Only run if this is a release commit created by script/release. + # Match either the direct commit message from script/release + # ("release X.Y.Z") or the merge-commit body containing the release + # PR title ("Release X.Y.Z"), so a normal PR merge still triggers. + # Also always run on manual workflow_dispatch. + if: | + github.event_name == 'workflow_dispatch' || + startsWith(github.event.head_commit.message, 'release ') || + contains(github.event.head_commit.message, 'Release ') steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} - persist-credentials: false + persist-credentials: true - name: Set up Ruby uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b