ci: dispatch release after auto-tag#12
Conversation
📝 WalkthroughWalkthroughThe ChangesWorkflow updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-tag.yml:
- Around line 8-10: The workflow-level write permission is too broad; remove the
top-level permissions block (the global "permissions: actions: write" /
"contents: write") and instead add a scoped permissions block under the tag job
(jobs.tag.permissions) granting only the necessary permissions (e.g., actions:
write and contents: write if the tag job needs to push tags). Update the YAML to
place permissions under the job named "tag" (jobs.tag.permissions) so other jobs
no longer inherit elevated token access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 47995084-43bd-47e6-886c-488e19e0e983
📒 Files selected for processing (1)
.github/workflows/auto-tag.yml
| permissions: | ||
| actions: write | ||
| contents: write |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify dispatch contract and permission placement impact (read-only).
set -euo pipefail
echo "== auto-tag permissions blocks =="
rg -n -C2 '^\s*permissions:|actions:\s*write|contents:\s*write' .github/workflows/auto-tag.yml
echo
echo "== release workflow supports workflow_dispatch =="
fd -a 'release\.yml$' .github/workflows | while read -r f; do
echo "-- $f"
rg -n -C2 '^\s*on:|workflow_dispatch' "$f" || true
doneRepository: antonio-orionus/url-sanitize
Length of output: 374
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== auto-tag.yml (relevant ranges) =="
nl -ba .github/workflows/auto-tag.yml | sed -n '1,120p'Repository: antonio-orionus/url-sanitize
Length of output: 170
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== auto-tag.yml (lines 1-120, numbered) =="
awk '{printf "%d:%s\n", NR, $0}' .github/workflows/auto-tag.yml | sed -n '1,120p'
echo
echo "== auto-tag.yml (lines 120-end, numbered) =="
awk '{printf "%d:%s\n", NR, $0}' .github/workflows/auto-tag.yml | sed -n '121,260p'Repository: antonio-orionus/url-sanitize
Length of output: 2180
Scope permissions: actions: write to the tag job (least privilege).
Workflow-level write permissions at .github/workflows/auto-tag.yml lines 8-10 apply to the whole workflow; move them under jobs.tag.permissions so future jobs don’t inherit elevated token access.
Proposed least-privilege change
-permissions:
- actions: write
- contents: write
-
jobs:
tag:
+ permissions:
+ actions: write
+ contents: write
if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main'
runs-on: ubuntu-latest📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| actions: write | |
| contents: write | |
| jobs: | |
| tag: | |
| permissions: | |
| actions: write | |
| contents: write | |
| if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' | |
| runs-on: ubuntu-latest |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 9-9: overly broad permissions (excessive-permissions): actions: write is overly broad at the workflow level
(excessive-permissions)
[error] 10-10: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-tag.yml around lines 8 - 10, The workflow-level write
permission is too broad; remove the top-level permissions block (the global
"permissions: actions: write" / "contents: write") and instead add a scoped
permissions block under the tag job (jobs.tag.permissions) granting only the
necessary permissions (e.g., actions: write and contents: write if the tag job
needs to push tags). Update the YAML to place permissions under the job named
"tag" (jobs.tag.permissions) so other jobs no longer inherit elevated token
access.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 254-257: The post-release-public-smoke job unconditionally runs
node scripts/verify-published-release.mjs which validates Homebrew/Scoop even
when publish-package-managers skipped; update the workflow so either (A) make
post-release-public-smoke conditional on the package-manager publish step by
adding the same env check (if: env.PACKAGING_REPO_TOKEN != '') or by adding a
dependency on publish-package-managers success, or (B) change
publish-package-managers to explicitly fail when PACKAGING_REPO_TOKEN is
required but unset (instead of silently echoing “skipping”), or (C) alter
scripts/verify-published-release.mjs to detect PACKAGING_REPO_TOKEN and skip
Homebrew/Scoop validation when it’s not provided; refer to the job names
post-release-public-smoke and publish-package-managers and the script node
scripts/verify-published-release.mjs and env var PACKAGING_REPO_TOKEN when
implementing the fix.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 700124c1-bd1f-4231-9497-3999ebb1ce1e
📒 Files selected for processing (1)
.github/workflows/release.yml
| post-release-public-smoke: | ||
| needs: [publish-npm, publish-crates, publish-pypi, publish-package-managers] | ||
| if: startsWith(github.ref, 'refs/tags/') | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if publish-package-managers can succeed without publishing
rg -n -A3 -B3 'PACKAGING_REPO_TOKEN' .github/workflows/release.ymlRepository: antonio-orionus/url-sanitize
Length of output: 2009
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find the post-release-public-smoke job and show its relevant steps
rg -n -A120 'post-release-public-smoke:' .github/workflows/release.yml | head -n 160
# Locate the smoke script invocation (if any) within that job
rg -n 'post-release-public-smoke:|smoke|package-managers|homebrew|scoop|RUNNER_TEMP/package-managers|GITHUB_REF_NAME' .github/workflows/release.ymlRepository: antonio-orionus/url-sanitize
Length of output: 6825
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the verify script (or at least the sections related to homebrew/scoop and surfaced checks)
ls -la scripts/verify-published-release.mjs || true
wc -l scripts/verify-published-release.mjs || true
rg -n 'homebrew|scoop|tap|bucket|package[- ]managers|brew|Verify public release surfaces' scripts/verify-published-release.mjs || true
# Print the most relevant blocks around homebrew/scoop checks (keep output bounded)
rg -n -A80 -B20 'homebrew|scoop|tap|bucket|package[- ]managers|brew|scoop' scripts/verify-published-release.mjs | head -n 200Repository: antonio-orionus/url-sanitize
Length of output: 5627
Gate the smoke verification on package-manager publishing (or skip those checks when PACKAGING_REPO_TOKEN is unset)
publish-package-managerssucceeds without publishing whenPACKAGING_REPO_TOKENis empty (it only echoes “skipping” and all Homebrew/Scoop publishing steps are guarded byif: env.PACKAGING_REPO_TOKEN != '').post-release-public-smokealways runsnode scripts/verify-published-release.mjs "${GITHUB_REF_NAME}", and that script unconditionally validates the Homebrew formula and Scoop manifest for the release version.- Result: when package-manager publishing is skipped, the workflow fails at the smoke stage with Homebrew/Scoop mismatch errors, even though the real root cause is missing token configuration.
Make the smoke job (or the script) conditional on whether package-manager assets were published, or explicitly fail publish-package-managers when PACKAGING_REPO_TOKEN is required but not configured.
🧰 Tools
🪛 zizmor (1.25.2)
[info] 254-254: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 254 - 257, The
post-release-public-smoke job unconditionally runs node
scripts/verify-published-release.mjs which validates Homebrew/Scoop even when
publish-package-managers skipped; update the workflow so either (A) make
post-release-public-smoke conditional on the package-manager publish step by
adding the same env check (if: env.PACKAGING_REPO_TOKEN != '') or by adding a
dependency on publish-package-managers success, or (B) change
publish-package-managers to explicitly fail when PACKAGING_REPO_TOKEN is
required but unset (instead of silently echoing “skipping”), or (C) alter
scripts/verify-published-release.mjs to detect PACKAGING_REPO_TOKEN and skip
Homebrew/Scoop validation when it’s not provided; refer to the job names
post-release-public-smoke and publish-package-managers and the script node
scripts/verify-published-release.mjs and env var PACKAGING_REPO_TOKEN when
implementing the fix.
1 participant
Summary
Why
Tags pushed by GITHUB_TOKEN do not trigger a separate tag-push workflow run, so relying only on release.yml's push: tags trigger strands auto-created tags.
Validation
Summary by CodeRabbit