From 730aad058d7c064727d67b6768a189cd66ae01b8 Mon Sep 17 00:00:00 2001 From: mikim Date: Mon, 13 Jul 2026 14:17:30 +0900 Subject: [PATCH] ci(release): switch Release workflow to manual dispatch The Release workflow ran on push to main and failed because the repository does not permit GitHub Actions to create pull requests (Changesets' "Version Packages" PR). Nothing is published yet (no npm trusted publisher configured), so gate the workflow behind workflow_dispatch to stop failing runs on main. Documented the two prerequisites for re-enabling auto-release in CONTRIBUTING. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 7 +++++-- CONTRIBUTING.md | 18 +++++++++++++----- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0b9486f..9f8914b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,11 @@ name: Release on: - push: - branches: [main] + # Manual trigger for now. Re-enable `push: branches: [main]` once (1) a trusted + # publisher is configured on npmjs.com for each @ark/* package and (2) GitHub + # Actions is allowed to create pull requests + # (Settings → Actions → General → Workflow permissions). + workflow_dispatch: # OIDC trusted publishing to npm (no long-lived NPM_TOKEN). Requires a trusted # publisher to be configured on npmjs.com for each @ark/* package before the diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0aec5f5..cd566c2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -75,8 +75,16 @@ changes bump the minor and reuse the file; breaking changes publish a new ## Releasing -Releases are automated with **Changesets** and published to npm via **OIDC -trusted publishing** (no `NPM_TOKEN`). Before the first publish, a trusted -publisher must be configured on npmjs.com for each `@ark/*` package, pointing at -`.github/workflows/release.yml`. Merging the bot's “Version Packages” PR then -publishes the bumped packages with provenance attestations. +Releases use **Changesets** and publish to npm via **OIDC trusted publishing** +(no `NPM_TOKEN`). Merging the “Version Packages” PR publishes the bumped packages +with provenance attestations. + +The Release workflow is currently **manually dispatched** (Actions → Release → +Run workflow). Before switching its trigger back to `push` (auto-release), two +prerequisites must be in place: + +1. a trusted publisher configured on npmjs.com for each `@ark/*` package, + pointing at `.github/workflows/release.yml`; and +2. **Settings → Actions → General → Workflow permissions →** “Allow GitHub + Actions to create and approve pull requests” enabled (Changesets opens the + “Version Packages” PR).