fix: require explicit update downloads #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please PR | |
| # Opens / updates a "Release PR" whenever conventional-commits land on main. | |
| # This workflow only manages the PR itself. The actual tag + draft release | |
| # creation is handled by `release-please-release.yml` on release-PR merge | |
| # commits, which avoids release/PR race conditions. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Ignore release-PR merge commits (these only touch release metadata files). | |
| # They are handled by release-please-release.yml. | |
| paths-ignore: | |
| - "CHANGELOG.md" | |
| - "package.json" | |
| - ".release-please-manifest.json" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: release-please-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 1 | |
| - id: gate | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| manifest_version="$(jq -r '.["."]' .release-please-manifest.json)" | |
| tag="v${manifest_version}" | |
| if ! git ls-remote --tags "https://github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${tag}" | grep -q .; then | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| echo "Release baseline tag ${tag} is missing; skipping PR generation to avoid changelog backfill." | |
| exit 0 | |
| fi | |
| release_json="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${tag}" 2>/dev/null || true)" | |
| if [[ -z "${release_json}" ]]; then | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| echo "Release ${tag} is not visible yet; skipping PR generation to avoid changelog backfill." | |
| exit 0 | |
| fi | |
| if [[ "$(jq -r '.draft' <<<"${release_json}")" == "true" ]]; then | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| echo "Release ${tag} is still draft; skipping PR generation until publish-release completes." | |
| exit 0 | |
| fi | |
| echo "skip=false" >> "$GITHUB_OUTPUT" | |
| echo "Release baseline ${tag} is published; proceeding." | |
| - uses: googleapis/release-please-action@v4 | |
| if: steps.gate.outputs.skip != 'true' | |
| with: | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| skip-github-release: true | |
| # IMPORTANT: tags created by GITHUB_TOKEN do NOT trigger other | |
| # workflows (GitHub deliberately breaks action→action chains). We | |
| # need release.yml to fire on the v* tag push so bins get built, | |
| # so use a fine-grained PAT with Contents:write + PRs:write on | |
| # this repo, stored as repo secret RELEASE_PLEASE_TOKEN. | |
| # Fallback to GITHUB_TOKEN so the workflow doesn't hard-fail when | |
| # the secret isn't configured; you'll just have to re-push tags | |
| # manually (git push --delete origin vX.Y.Z && git push origin | |
| # vX.Y.Z) to trigger the build. | |
| token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} |