Skip to content

Fix release workflow#1491

Merged
nscuro merged 1 commit intoDependencyTrack:masterfrom
nscuro:fix-release-workflow
Apr 3, 2026
Merged

Fix release workflow#1491
nscuro merged 1 commit intoDependencyTrack:masterfrom
nscuro:fix-release-workflow

Conversation

@nscuro
Copy link
Copy Markdown
Member

@nscuro nscuro commented Apr 3, 2026

Description

Fixes release workflow.

It turns out that creating a draft release doesn't trigger a release: created event. Instead, we need to push a tag, which then fires the push: tags event.

For this to work, the push must be performed with a non-default PAT. A BOT_RELEASE_GITHUB_TOKEN secrets has been created with minimal privileges, and scoped to this repository.

Note that tags were previously created implicitly when creating the GitHub release.

Addressed Issue

N/A

Additional Details

N/A

Checklist

It turns out that creating a draft release doesn't trigger a `release: created` event. Instead, we need to push a tag, which then fires the `push: tags` event.

For this to work, the push must be performed with a non-default PAT. A BOT_RELEASE_GITHUB_TOKEN secrets has been created with minimal privileges, and scoped to this repository.

Note that tags were previously created implicitly when creating the GitHub release.

Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro added the backport/4.14.1 PRs to be backported to version 4.14.1 label Apr 3, 2026
Copilot AI review requested due to automatic review settings April 3, 2026 16:23
@owasp-dt-bot
Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the release/publish GitHub Actions workflows so that publishing is triggered by pushing a version tag (instead of relying on a release: created event), and ensures the tag push is performed with a non-default bot PAT.

Changes:

  • Update the publish workflow trigger from release: created to push on version tags.
  • Adjust the release workflow to create a version tag via npm version (no v prefix), push the tag, and use BOT_RELEASE_GITHUB_TOKEN for authenticated operations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/ci-release.yaml Uses bot PAT for checkout + GitHub release creation; ensures npm version produces a numeric tag and pushes it.
.github/workflows/ci-publish.yaml Switches publish trigger to push events for numeric tags to align with tag-based release flow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@nscuro nscuro merged commit f445f69 into DependencyTrack:master Apr 3, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/4.14.1 PRs to be backported to version 4.14.1

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants