From d2f350d7f51d4f591543aa9b0304959f25c27a25 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 21 Jul 2026 13:54:02 -0700 Subject: [PATCH 1/5] fix(ci): release from the dispatched branch instead of a branch input A reusable workflow's job definition (including the node-version test matrix) is always read from the same git ref as the caller, not from the checked-out code. So passing a 'branch' input could only change which code was tested, never which matrix ran -- releasing v4.x from master would still test against master's node versions and miss v4.x-only versions (18.x/20.x). Drive the release off github.ref_name so the branch being released is the ref the workflow runs on: its own shared-ci matrix and jobs apply. Remove the misleading 'branch' input from both prod-release and shared-ci. shared-ci now checks out the triggering ref by default (PR merge ref for CI, dispatched branch for release). Publish checks out by branch name so it includes the version-bump commit pushed by the version job. To release a branch, dispatch the Release workflow from that branch. --- .github/workflows/prod-release.yml | 13 +++++++------ .github/workflows/shared-ci.yml | 9 +++------ 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml index ffddc0dc2..f478dd1a5 100644 --- a/.github/workflows/prod-release.yml +++ b/.github/workflows/prod-release.yml @@ -14,10 +14,6 @@ on: description: 'NPM distribution tag' required: false default: 'latest' - branch: - description: 'The branch to release from' - required: false - default: 'master' env: NODE_OPTIONS: "--max-old-space-size=4096" @@ -73,8 +69,11 @@ jobs: gh auth setup-git - name: Configure git + # Release the branch the workflow was dispatched from. The reusable + # shared-ci workflow's test matrix is read from this same ref, so the + # branch being released must be the ref the workflow runs on. env: - BRANCH: ${{ github.event.inputs.branch }} + BRANCH: ${{ github.ref_name }} run: | git config --global user.name "aws-crypto-tools-ci-bot" git config --global user.email "no-reply@noemail.local" @@ -94,9 +93,11 @@ jobs: needs: [pre-release-ci, version] environment: release steps: + # Check out by branch name (not the triggering SHA) so we pick up the + # version-bump commit the `version` job just pushed to this branch. - uses: actions/checkout@v4 with: - ref: ${{ github.event.inputs.branch }} + ref: ${{ github.ref_name }} - uses: actions/setup-node@v4 with: diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml index 045c5e553..192df922b 100644 --- a/.github/workflows/shared-ci.yml +++ b/.github/workflows/shared-ci.yml @@ -3,11 +3,6 @@ name: Shared CI Tests on: workflow_call: inputs: - branch: - description: "Branch to checkout" - required: false - default: master - type: string test-published-packages: description: 'Test against published packages instead of checked out code' required: false @@ -37,9 +32,11 @@ jobs: steps: - name: Checkout code # Always need repo for test scripts and configuration, even when testing published packages + # No explicit ref: checkout defaults to the ref that triggered the + # run (the PR merge ref for CI, or the dispatched branch for a release), + # which keeps the tested code and this workflow's matrix on the same branch. uses: actions/checkout@v4 with: - ref: ${{ inputs.branch }} fetch-depth: 0 submodules: true From 7fc3794df420bcdd0a6cbcb756c1f8f6abd4c9de Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 21 Jul 2026 14:06:34 -0700 Subject: [PATCH 2/5] chore(ci): trim slop comments --- .github/workflows/prod-release.yml | 6 +----- .github/workflows/shared-ci.yml | 3 --- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml index f478dd1a5..633a87588 100644 --- a/.github/workflows/prod-release.yml +++ b/.github/workflows/prod-release.yml @@ -69,9 +69,6 @@ jobs: gh auth setup-git - name: Configure git - # Release the branch the workflow was dispatched from. The reusable - # shared-ci workflow's test matrix is read from this same ref, so the - # branch being released must be the ref the workflow runs on. env: BRANCH: ${{ github.ref_name }} run: | @@ -93,8 +90,7 @@ jobs: needs: [pre-release-ci, version] environment: release steps: - # Check out by branch name (not the triggering SHA) so we pick up the - # version-bump commit the `version` job just pushed to this branch. + # Include the version-bump commit the version job pushed - uses: actions/checkout@v4 with: ref: ${{ github.ref_name }} diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml index 192df922b..88233a595 100644 --- a/.github/workflows/shared-ci.yml +++ b/.github/workflows/shared-ci.yml @@ -32,9 +32,6 @@ jobs: steps: - name: Checkout code # Always need repo for test scripts and configuration, even when testing published packages - # No explicit ref: checkout defaults to the ref that triggered the - # run (the PR merge ref for CI, or the dispatched branch for a release), - # which keeps the tested code and this workflow's matrix on the same branch. uses: actions/checkout@v4 with: fetch-depth: 0 From cc5a58ab6fda0778a15628a4f7502e2fe2c0e6ff Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 21 Jul 2026 21:15:53 +0000 Subject: [PATCH 3/5] fix(ci): keep an optional branch input on shared-ci ci.yml forwards `branch` to shared-ci.yml, but that input was just removed, so the reusable-workflow call failed at startup on every pull_request run. Re-add `branch` as optional (default empty = the triggering ref) and forward it from ci.yml without the `|| 'master'` fallback. PR CI now checks out the PR ref instead of master, release still uses the dispatched ref, and daily CI can still target the v4.x maintenance branch. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/shared-ci.yml | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a06f052fb..4c785be64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,16 +9,16 @@ on: workflow_call: inputs: branch: - description: "Branch to checkout" + description: "Ref to check out. Empty (the default) uses the ref that triggered the run." required: false - default: master + default: '' type: string jobs: shared-ci: uses: ./.github/workflows/shared-ci.yml with: - branch: ${{ inputs.branch || 'master' }} + branch: ${{ inputs.branch }} pr-ci-all-required: if: always() needs: diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml index 88233a595..e4125cd86 100644 --- a/.github/workflows/shared-ci.yml +++ b/.github/workflows/shared-ci.yml @@ -3,6 +3,11 @@ name: Shared CI Tests on: workflow_call: inputs: + branch: + description: 'Ref to check out. Empty (the default) uses the ref that triggered the run.' + required: false + default: '' + type: string test-published-packages: description: 'Test against published packages instead of checked out code' required: false @@ -34,6 +39,7 @@ jobs: # Always need repo for test scripts and configuration, even when testing published packages uses: actions/checkout@v4 with: + ref: ${{ inputs.branch }} fetch-depth: 0 submodules: true From 1df55a75e214e42990d746f8d1eb7689e4166477 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 21 Jul 2026 21:27:57 +0000 Subject: [PATCH 4/5] fix(ci): quote $BRANCH in the release checkout --- .github/workflows/prod-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml index 633a87588..7ed5a1de0 100644 --- a/.github/workflows/prod-release.yml +++ b/.github/workflows/prod-release.yml @@ -74,7 +74,7 @@ jobs: run: | git config --global user.name "aws-crypto-tools-ci-bot" git config --global user.email "no-reply@noemail.local" - git checkout $BRANCH + git checkout "$BRANCH" - name: Version packages env: From 43c15b5afd4d81ffe6ac9cc29837259ff6a1ab43 Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Tue, 21 Jul 2026 14:57:02 -0700 Subject: [PATCH 5/5] fix(ci): drop the branch input; run from the dispatched ref The workflow ref is the only branch selector. Remove the branch input from ci.yml and shared-ci.yml so checkout always uses the triggering ref, keeping tested code and the reusable-workflow matrix on the same branch. Guard the release against non-branch dispatch (lerna version pushes to the branch head). --- .github/workflows/ci.yml | 12 +----------- .github/workflows/prod-release.yml | 6 ++++++ .github/workflows/shared-ci.yml | 6 ------ 3 files changed, 7 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4c785be64..e299c7349 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,21 +4,11 @@ permissions: contents: read id-token: write -on: - pull_request: - workflow_call: - inputs: - branch: - description: "Ref to check out. Empty (the default) uses the ref that triggered the run." - required: false - default: '' - type: string +on: [pull_request, workflow_call] jobs: shared-ci: uses: ./.github/workflows/shared-ci.yml - with: - branch: ${{ inputs.branch }} pr-ci-all-required: if: always() needs: diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml index 7ed5a1de0..8b0e84697 100644 --- a/.github/workflows/prod-release.yml +++ b/.github/workflows/prod-release.yml @@ -29,6 +29,12 @@ jobs: needs: [pre-release-ci] environment: release steps: + - name: Require a branch + if: github.ref_type != 'branch' + run: | + echo "::error::Dispatch this workflow from a branch (got ${{ github.ref_type }} '${{ github.ref_name }}'). To release a specific commit, point a branch at it first." + exit 1 + - name: Checkout code uses: actions/checkout@v4 with: diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml index e4125cd86..88233a595 100644 --- a/.github/workflows/shared-ci.yml +++ b/.github/workflows/shared-ci.yml @@ -3,11 +3,6 @@ name: Shared CI Tests on: workflow_call: inputs: - branch: - description: 'Ref to check out. Empty (the default) uses the ref that triggered the run.' - required: false - default: '' - type: string test-published-packages: description: 'Test against published packages instead of checked out code' required: false @@ -39,7 +34,6 @@ jobs: # Always need repo for test scripts and configuration, even when testing published packages uses: actions/checkout@v4 with: - ref: ${{ inputs.branch }} fetch-depth: 0 submodules: true