Repository navigation
🐛 fix(release): finish recovered releases from main - #296
Merged
gaborbernat merged 2 commits intoNov 4, 2026
Merged
Conversation
The release environment only allows v* tags, but the finalize workflow is dispatched from main, so its job was rejected before it ran. The job reads nothing from the environment: it uses github.token and checks the downloaded artifacts against the Marketplace acceptance receipt. Write access moves from the workflow to the finalize job, so the permission is scoped to the one job that needs it.
A release recovered through this workflow skipped the version bump that the tag run opens after the GitHub release, so the next dev version never got its pull request. The finalize workflow now runs the same prepare and PR jobs as release.yaml, with the same App token handling. The release-auth environment allows main, the branch this workflow is dispatched from.
gaborbernat
added
bug
gaborbernat
added a commit
that referenced
this pull request
Nov 4, 2026
The `finalize-github-release` workflow was added in [#295](#295) and [#296](#296) to finish releases whose GitHub release step hit a 403. That recovery path fails with the same 403, and the maintainer chose normal releases instead, so the workflow has no purpose left. Nothing else references it. Releases continue through the existing release workflow, which this change leaves untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v2.4.8 GitHub release is still missing. The recovery workflow from #295 fails before it publishes anything, because its job requires the
releaseenvironment, and that environment only allowsv*tags while the workflow runs frommain(see run 41798202652). 🚀 After this merges, a recovered release ends the way a normal tag run ends: the GitHub release is published, and then the version bump pull request is opened.The recovery workflow keeps its verification role. It takes the tag, the source run and the artifact IDs, checks the downloaded plugin ZIP and release notes against the Marketplace acceptance receipt, and only then publishes. Write access sits on that one job. The
releaseenvironment is no longer part of the path, because the job reads no secrets and the receipt check is what guards the artifacts.The post-release jobs run after the publish job and use the same shared actions, with the same App token handling, as the tag workflow. They run in the
release-authenvironment, which already allowsmain, the branch this workflow is dispatched from. The tag workflow does not change.