From 813f6669c27a1572e0b9d43f44cccb8eb29c83bb Mon Sep 17 00:00:00 2001 From: David Cramer Date: Sat, 11 Jul 2026 13:49:12 -0400 Subject: [PATCH] fix(ci): Avoid unauthenticated release ref fetch Validate the complete ref snapshot immediately after checkout instead of fetching again without persisted credentials. Keep setup work after validation and make the release fixture fail if another network fetch is introduced. Co-Authored-By: OpenAI Codex --- .github/workflows/release.yml | 11 +++++------ test/release-workflow.test.js | 1 + 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e0032b4..dec6f86 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,11 +29,6 @@ jobs: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 24 - cache: npm - - name: Validate release run: | if [[ "$GITHUB_REF" != "refs/heads/main" ]]; then @@ -41,7 +36,6 @@ jobs: exit 1 fi - git fetch origin main --tags if [[ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]]; then if [[ "$GITHUB_RUN_ATTEMPT" == "1" ]] || ! git tag --points-at "$GITHUB_SHA" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then echo "new releases must use the latest commit on main" >&2 @@ -54,6 +48,11 @@ jobs: echo "Retrying a partially published release after main advanced" fi + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 24 + cache: npm + - name: Calculate version id: release env: diff --git a/test/release-workflow.test.js b/test/release-workflow.test.js index fe94c5d..17a9a38 100644 --- a/test/release-workflow.test.js +++ b/test/release-workflow.test.js @@ -63,6 +63,7 @@ function validateAfterMainAdvances(attempt, { tag = true } = {}) { execFileSync("git", ["commit", "-am", "later"], { cwd: checkout }); execFileSync("git", ["push", "origin", "main"], { cwd: checkout }); execFileSync("git", ["checkout", "--detach", releaseSha], { cwd: checkout }); + execFileSync("git", ["remote", "set-url", "origin", path.join(directory, "unreachable.git")], { cwd: checkout }); return () => execFileSync("bash", ["-euo", "pipefail", "-c", validateRelease], { cwd: checkout,