fix releases: make protected-branch publishing repeatable - #128
Merged
Conversation
Coverage Report
File CoverageNo changed files found. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The workflow and documentation changes align with the stated failure modes and add concrete safeguards without introducing apparent release-breaking behavior.
Pull request overview
This PR makes the tag-triggered npm release process repeatable with protected main by ensuring version preparation happens on a mergeable branch, and by adding workflow guardrails so publishing only happens from an on-main commit with a matching tag/version.
Changes:
- Document a “prepare on branch → merge → tag from
main” release procedure in the README. - Update
pnpm releaseto bump the version without creating a git tag. - Harden the release workflow by validating tag/version alignment, ensuring the tagged commit is on
main, and downloading the package artifact before setting up pnpm in the publish job.
File summaries
| File | Description |
|---|---|
| README.md | Adds a documented, protected-branch-friendly release procedure (prepare, merge, tag). |
| package.json | Records v0.3.9 on main and changes the release script to avoid creating tags locally. |
| .github/workflows/release.yml | Adds tag/branch validation and reorders publish steps to download the artifact before pnpm setup. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
mscolnick
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was authored by a coding agent.
The v0.3.9 release exposed two failure modes in the tag-based process. The publish job tried to configure pnpm before downloading the package metadata, and the version command created an immutable tag before its commit could enter protected
main.This change records the published v0.3.9 version on
main, downloads the package artifact before configuring pnpm, and makespnpm releaseprepare only the version change. The release workflow now rejects a mismatched tag or a commit that is not onmain. The README documents the short prepare, merge, and tag procedure.