From 284500502ad195a15bf61783f9596506ebfd4194 Mon Sep 17 00:00:00 2001
From: Joel Hawksley <joel@hawksley.org>
Date: Mon, 24 Aug 2026 14:36:13 -0600
Subject: [PATCH] Dispatch push_gem against the tag ref
 (env-protection-compatible)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'release' environment restricts deployments to v* tag refs — 'main'
is not allowed to deploy. So my previous 'gh workflow run --ref main'
was blocked with:

  Branch "main" is not allowed to deploy to release due to environment
  protection rules.

Fix: dispatch push_gem.yml with --ref "$tag" instead. That way the
deployment runs against the tag ref, satisfying the environment's v*
restriction. The workflow's checkout can then use github.ref directly,
so drop the redundant 'tag' input and ref override.

Note: this dispatch requires the workflow_dispatch trigger to exist on
the tag itself. Because push_gem.yml lands on main before any future
release cuts a tag, that tag will always include the trigger. Only the
already-created v4.14.0 tag (from before we added workflow_dispatch)
lacks it — that has to be recovered manually by re-tagging v4.14.0 at
current main HEAD.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 217f0a0d-a9f2-4607-9643-5fcb3e34f20f
---
 .github/workflows/push_gem.yml | 6 ------
 script/publish                 | 6 ++++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/push_gem.yml b/.github/workflows/push_gem.yml
index 2db5144b3..8d5278535 100644
--- a/.github/workflows/push_gem.yml
+++ b/.github/workflows/push_gem.yml
@@ -5,11 +5,6 @@ on:
     tags:
       - v*
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to push to RubyGems (e.g. v4.14.0)'
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -35,7 +30,6 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
           persist-credentials: false
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
diff --git a/script/publish b/script/publish
index d37414475..ba9da58be 100755
--- a/script/publish
+++ b/script/publish
@@ -77,7 +77,9 @@ gh release create "$tag" \
 # the tag push above will not fire push_gem.yml on its own when this
 # script runs inside the publish-release workflow. Dispatch it here so
 # 'script/publish' always results in a gem being pushed to RubyGems.
+#
+# Dispatch against the tag ref (not main) because the 'release'
+# environment restricts deployments to v* tags.
 gh workflow run push_gem.yml \
   --repo ViewComponent/view_component \
-  --ref main \
-  --field tag="$tag" || true
+  --ref "$tag" || true