Skip to content

Repair the Release workflow, and lint workflows in CI #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
louisbels merged 1 commit into from
Jul 26, 2026
Merged

Repair the Release workflow, and lint workflows in CI #137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,19 @@ jobs:
- name: Verify the publishable SDK artifact
run: pnpm --filter @largerio/secret-sdk verify-package

# A workflow file that fails to parse does not fail loudly: GitHub silently
# runs nothing. A bad `if:` expression took the Release workflow out of
# service and the only visible symptom was a run with zero jobs.
workflows:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Lint GitHub Actions workflows
uses: docker://rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9

e2e:
runs-on: ubuntu-latest
permissions:
Expand Down Expand Up @@ -129,7 +142,7 @@ jobs:
# Every gate must pass before an image is published: with `needs: check`
# alone, a tag push could build, push and deploy while e2e was still
# running — shipping a regression, a known CVE or a leaked secret.
needs: [check, e2e, audit, secrets]
needs: [check, e2e, audit, secrets, workflows]
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
permissions:
Expand Down
7 changes: 6 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,11 @@ jobs:
contents: write # push the version commit / create the Version Packages PR branch
pull-requests: write # open and update the Version Packages PR
id-token: write # OIDC: authenticate to npm via trusted publishing (no token)
env:
# `secrets` is not one of the contexts available to a step-level `if`
# (GitHub rejects the whole file), but it is available here — so resolve
# it once at job level and branch on the result below.
HAS_RELEASE_APP: ${{ secrets.APP_ID != '' }}
steps:
# A PR opened with the default GITHUB_TOKEN never triggers `pull_request`
# workflows — GitHub suppresses them to avoid recursion. The "Version
Expand All @@ -37,7 +42,7 @@ jobs:
# App ID / private key stored as the APP_ID and APP_PRIVATE_KEY secrets.
- name: Mint a GitHub App token
id: app-token
if: ${{ secrets.APP_ID != '' }}
if: env.HAS_RELEASE_APP == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.APP_ID }}
Expand Down