Skip to content

Commit 3badad6

Browse files
santiagomedsantiagomed
committed
ci: stop the duplicate GoReleaser run on release
Cutting a release produced a spurious failed workflow run. The Cut Release job pushes the tag with RELEASE_GITHUB_TOKEN (a PAT), and PAT-pushed tags DO trigger workflows — contrary to the job's comment that assumed GITHUB_TOKEN semantics. So the tag push fired the Release workflow's tag-push GoReleaser, which raced the Cut Release job's own GoReleaser and failed uploading duplicate release assets (422 already_exists). Cut Release already owns GoReleaser (binaries + Homebrew cask) and dispatches the Release workflow for the OIDC npm publish. So make the Release workflow npm-only and workflow_dispatch-only: drop its tag-push trigger and its now-redundant GoReleaser job. This removes the racing run entirely while leaving the proven publish path unchanged. Also correct the stale comment in cut-release.yml about tag-push workflow triggering.
1 parent c440e59 commit 3badad6

2 files changed

Lines changed: 18 additions & 50 deletions

File tree

‎.github/workflows/cut-release.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,10 @@ jobs:
153153
154154
git tag -a "$TAG" -m "${TAG}"
155155
156-
# Push main (if we committed) and the tag. GITHUB_TOKEN tag pushes do
157-
# not trigger other workflows, so publish runs in the steps below.
156+
# Push main (if we committed) and the tag. This job owns publishing:
157+
# GoReleaser runs below and npm is dispatched to the Release workflow.
158+
# The Release workflow has no tag-push trigger, so this tag push does
159+
# not spawn a second, racing GoReleaser run.
158160
if ! git push origin HEAD:main "refs/tags/${TAG}"; then
159161
{
160162
echo "## Cut Release: push rejected"

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,31 @@
11
name: Release
22

3+
# npm publisher for the xurl launcher. This workflow only publishes to npm via
4+
# OIDC trusted publishing (npmjs.com binds the trusted publisher to this file).
5+
# Binaries, the GitHub release, and the Homebrew cask are produced by GoReleaser
6+
# inside the "Cut Release" workflow, which dispatches this one for the npm step.
7+
#
8+
# It is workflow_dispatch only. It deliberately does NOT trigger on tag pushes:
9+
# "Cut Release" pushes the tag (with a PAT) and runs GoReleaser itself, so a
10+
# tag-push trigger here would race that GoReleaser and fail uploading duplicate
11+
# release assets.
312
on:
4-
push:
5-
tags:
6-
- "v*"
713
workflow_dispatch:
814
inputs:
915
version:
10-
description: "Version to publish to npm (e.g. 1.2.0, no leading v). Use this to (re)publish npm without re-running GoReleaser."
16+
description: "Version to publish to npm (e.g. 1.2.0, no leading v)."
1117
required: true
1218
type: string
1319

1420
permissions:
1521
contents: read
1622

1723
jobs:
18-
goreleaser:
19-
# Build binaries, create the GitHub release, and update the Homebrew cask.
20-
# Runs only on a tag push; npm publishing is a separate job so an npm-side
21-
# failure never blocks the GitHub release / Homebrew cask, and so npm can be
22-
# (re)published independently via workflow_dispatch.
23-
if: github.event_name == 'push'
24-
runs-on: ubuntu-latest
25-
permissions:
26-
contents: write
27-
steps:
28-
- uses: actions/checkout@v4
29-
with:
30-
fetch-depth: 0
31-
32-
- name: Set up Go
33-
uses: actions/setup-go@v5
34-
with:
35-
go-version: "1.24"
36-
37-
- name: Run tests
38-
run: go test ./...
39-
40-
- name: Run GoReleaser
41-
uses: goreleaser/goreleaser-action@v6
42-
with:
43-
version: "~> v2"
44-
args: release --clean
45-
env:
46-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
47-
HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
48-
4924
publish-npm:
50-
# Publishes the npm launcher. Runs after a successful GoReleaser on a tag
51-
# push, and can also be triggered manually (workflow_dispatch) to publish or
52-
# re-publish a specific version without re-running GoReleaser.
53-
needs: [goreleaser]
54-
if: ${{ always() && (github.event_name == 'workflow_dispatch' || needs.goreleaser.result == 'success') }}
5525
runs-on: ubuntu-latest
5626
permissions:
5727
contents: read
58-
id-token: write # enables npm provenance, and OIDC trusted publishing if configured
28+
id-token: write # enables npm provenance and OIDC trusted publishing
5929
steps:
6030
- uses: actions/checkout@v4
6131

@@ -75,13 +45,9 @@ jobs:
7545

7646
- name: Resolve version
7747
id: ver
78-
run: |
79-
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
80-
VERSION="${{ github.event.inputs.version }}"
81-
else
82-
VERSION="${GITHUB_REF_NAME}"
83-
fi
84-
echo "version=${VERSION#v}" >> "$GITHUB_OUTPUT"
48+
env:
49+
VERSION: ${{ github.event.inputs.version }}
50+
run: echo "version=${VERSION#v}" >> "$GITHUB_OUTPUT"
8551

8652
- name: Publish to npm (OIDC trusted publishing)
8753
run: |

0 commit comments

Comments
 (0)