From 5106bb89764ba65269ca09a3ceb671aa1fdb610d Mon Sep 17 00:00:00 2001 From: unional Date: Sun, 30 Aug 2026 23:43:49 -0700 Subject: [PATCH] ci: run the publish gate on release, not on the version PR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate was a job on the changesets "Version Packages" PR, conditional on `startsWith(github.head_ref, 'changeset-release/')`. That PR is opened with the built-in GITHUB_TOKEN, and GitHub does not trigger `on: pull_request` workflows for such a PR, so it carries zero checks and the gate has never run. Move it into `release.yml` as a `needs:` of the release job, where it runs on the default branch immediately before `changeset publish`. The gate is self-contained — it packs the working tree and diffs that against the registry — so it needs no PR context. This also means it runs on pushes that only open or update the Version PR rather than publish. That is deliberate: it fails closed, and surfaces a bad tarball one merge earlier. Requires cyberuni/.github's matching gate fix to land first, or the gate inspects nothing on single-package repos. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014RLRX3QtRpgCfDt16KShQC --- .github/workflows/pull-request.yml | 6 ------ .github/workflows/release.yml | 15 ++++++++++++++- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index f12d3a4..bfad3a0 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -10,9 +10,3 @@ jobs: with: os: '["ubuntu-latest"]' skip-playwright: true - - publish-gate: - if: startsWith(github.head_ref, 'changeset-release/') - uses: cyberuni/.github/.github/workflows/pnpm-publish-gate.yml@main - permissions: - contents: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ce8cc8a..8763fa4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,9 +10,22 @@ jobs: os: '["ubuntu-latest"]' skip-playwright: true + # Runs on the default branch immediately before `changeset publish`, so a tarball that + # trips the gate blocks the release. It used to sit on the changesets "Version + # Packages" PR instead, where it could never fire: a PR opened with the built-in + # GITHUB_TOKEN does not trigger `on: pull_request`, so that PR gets zero checks and + # the job attached to it was never once executed. + # + # A `needs:` of release, so it also runs on pushes that only open or update the + # Version PR rather than publish. Deliberate — it fails closed. + publish-gate: + uses: cyberuni/.github/.github/workflows/pnpm-publish-gate.yml@main + permissions: + contents: read + release: uses: cyberuni/.github/.github/workflows/pnpm-release-changeset-oidc.yml@main - needs: code + needs: [code, publish-gate] permissions: id-token: write contents: write