Automatically publish dev builds after PR merges and tag builds#158
Automatically publish dev builds after PR merges and tag builds#158fhammerschmidt wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f557f5fdc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| concurrency: | ||
| group: npm-publish-master | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
Because every dev and release publish uses the same concurrency group, GitHub's concurrency behavior keeps at most one running and one pending run, and a newer queued run cancels any existing pending run. If a vX.Y.Z tag push is pending behind a dev publish and another merge/tag event arrives before it starts, the pending release run is canceled and there is no later trigger for that tag, so the npm latest release is skipped; use separate groups for tags/dev builds or a real queue.
Useful? React with 👍 / 👎.
| pull_request: | ||
| branches: [ master ] | ||
| types: [ closed ] |
There was a problem hiding this comment.
When a merged PR was opened from a fork, this still runs as a pull_request event from a fork. GitHub's permissions docs say forked pull_request runs other than pull_request_target have write permissions downgraded, and id-token: write is required for npm trusted publishing to fetch an OIDC token, so external-contributor merges won't be able to publish the dev package under the default fork settings. Triggering dev publishes on push to master uses the trusted merged commit and preserves OIDC.
Useful? React with 👍 / 👎.
tsnobip
left a comment
tsnobip
left a comment
There was a problem hiding this comment.
except from the things raised by codex, I think this looks good!
2 participants
No description provided.