From 4b5d62e405ad0592f4d2e54c538ff0e17b56d875 Mon Sep 17 00:00:00 2001 From: dan-claude-bot Date: Sun, 19 Jul 2026 16:14:13 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20one=20on.push=20key=20=E2=80=94=20YAML?= =?UTF-8?q?=20last-key-wins=20had=20dropped=20the=20tag=20door?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit grok's round-2 catch: two sibling push: maps under on: leave only the second (branches: [main]) alive — the tag-push fallback stopped triggering entirely. Both filters now live under one push key, the jobs still split on the pushed ref, and a pin counts exactly one on.push. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67b49f2..6d9ca3c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,19 +18,20 @@ name: release # pure-bash tree, GitHub's source tarball for the tag IS the package # (install.sh downloads archive/refs/tags/). on: + # ONE push key, both filters — YAML maps are last-key-wins, so a second + # sibling `push:` would silently REPLACE the first and kill a door + # (grok's round-2 catch: the tag fallback had stopped triggering). push: # Every tag, not a shape filter: a tag that mismatches VERSION must fail # LOUDLY below, not be silently skipped by a pattern that didn't match. tags: ['**'] - push: # The merge-is-the-release path (#47) rides pushes to MAIN, not - # pull_request events, for one load-bearing reason the first review - # round caught: a workflow run triggered by a pull_request from a - # public FORK gets a READ-ONLY GITHUB_TOKEN — `permissions:` cannot - # raise that ceiling — and every ceremony PR this org has ever merged - # is cross-repo from the bot fork. The asserts would pass and the tag - # create would 403, red on main, every release. A push to main is an - # in-repo event with the full write token, whoever authored the PR. + # pull_request events: a pull_request run from a public FORK gets a + # READ-ONLY GITHUB_TOKEN — `permissions:` cannot raise that ceiling — + # and every ceremony PR this org merges is cross-repo from the bot + # fork; the tag create would 403 after green asserts. A push to main + # is an in-repo event with the full write token, whoever authored the + # PR. The jobs split on the pushed ref. branches: [main] permissions: