Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -79,3 +79,32 @@ jobs:
- name: Publish to npm
if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
run: npm publish --tag latest

github-release:
needs: [npm-publish-latest]
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

github-release can run even when the actual npm publish step was skipped (e.g., it’s conditional on github.actor in npm-publish-latest, but this job isn’t). That can produce a GitHub Release/tag for a version that wasn’t published to npm. Consider mirroring the same actor condition here (or keying off an output from npm-publish-latest that indicates whether publishing occurred).

Suggested change
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
if: github.ref == 'refs/heads/main' && github.event_name == 'push' && github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'

Copilot uses AI. Check for mistakes.
permissions:
contents: write
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Create GitHub release with generated notes
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
TAG="v$(node -p "require('./package.json').version")"
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TAG assignment uses nested double quotes (TAG="v$(node -p "...")"), which will break bash parsing because the inner quotes terminate the outer quoted string. Use single quotes for the Node expression (or drop the outer quotes / escape the inner quotes) so the workflow can compute TAG correctly.

Suggested change
TAG="v$(node -p "require('./package.json').version")"
TAG=v$(node -p 'require("./package.json").version')

Copilot uses AI. Check for mistakes.

if gh release view "$TAG" >/dev/null 2>&1; then
echo "Release $TAG already exists. Skipping."
exit 0
fi

if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
echo "Tag $TAG already exists on origin. Creating release from existing tag."
gh release create "$TAG" --verify-tag --generate-notes
else
echo "Creating tag and release $TAG from commit $GITHUB_SHA."
gh release create "$TAG" --target "$GITHUB_SHA" --generate-notes
fi
Loading