Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/publish-package.yml
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,11 @@ jobs:
registry-url: 'https://registry.npmjs.org'
scope: "@sistent"

- name: "Set Package Version"
uses: reedyuk/npm-version@1.1.1
with:
version: ${{ github.event.release.tag_name }} || ${{ inputs.release_version }}

Comment on lines +38 to +42
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

version: is built by concatenating two separate expressions with a literal || in between, which will yield strings like v1.2.3 || and fail semver parsing. Use a single GitHub Actions expression for fallback selection (e.g., github.event.release.tag_name || inputs.release_version) or reuse the existing RELEASE_VERSION logic from the later step. Also note this step appears redundant with the existing "Update Release Version" step that already runs npm version, so you likely want only one of them to avoid double-bumping the version/lockfile.

Suggested change
- name: "Set Package Version"
uses: reedyuk/npm-version@1.1.1
with:
version: ${{ github.event.release.tag_name }} || ${{ inputs.release_version }}

Copilot uses AI. Check for mistakes.
- name: Install Dependencies
run: npm ci
env:
Expand Down Expand Up @@ -70,6 +75,8 @@ jobs:
run: |
set -e
npm publish --provenance --access public --verbose
env:
NODE_AUTH_TOKEN: '' # Explicitly empty for install
Comment on lines +78 to +79
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step defines env: twice; YAML will take the latter, so NODE_AUTH_TOKEN becomes the empty string and npm publish will fail authentication. Remove the second env: block (or merge them) so the publish step uses secrets.NPM_TOKEN.

Suggested change
env:
NODE_AUTH_TOKEN: '' # Explicitly empty for install

Copilot uses AI. Check for mistakes.

- name: Pull changes from remote
run: git pull origin master
Expand Down