From 5f47fceaed954342500696a9a8ec8d557b2f2b43 Mon Sep 17 00:00:00 2001 From: Brandon Cook Date: Wed, 17 Jun 2026 11:36:34 +1000 Subject: [PATCH] ci(release): push release tag with KIT_RELEASE_TOKEN so the release pipeline fires MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release job's actions/checkout step had no `token:`, so the subsequent `git push origin "${TAG}"` in scripts/tag-release.sh authenticated with the default GITHUB_TOKEN. GitHub does NOT fire workflow triggers for tags pushed with GITHUB_TOKEN, so the downstream GoReleaser/Homebrew/notify pipeline silently never ran on a real release — manual workflow_dispatch was the only recovery. Persist KIT_RELEASE_TOKEN (a PAT) on the checkout that precedes the tag push so the tag push triggers the binary/Homebrew/notify pipeline. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b919378..405b0ed 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,14 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - with: { fetch-depth: 0 } + # The tag push in scripts/tag-release.sh must use a PAT, not the + # default GITHUB_TOKEN: GitHub does NOT fire workflow triggers for tags + # pushed with GITHUB_TOKEN, so the downstream GoReleaser/Homebrew/notify + # pipeline would silently never run. Persisting the PAT here makes the + # `git push origin "${TAG}"` use it. + with: + fetch-depth: 0 + token: ${{ secrets.KIT_RELEASE_TOKEN }} - uses: actions/setup-node@v4 with: { node-version: 22 } - run: npm ci