From 3c2dbd44979d635e0ef8acc3c58f7e0646175b7c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 13 Jun 2026 13:46:53 +0000
Subject: [PATCH 1/2] fix(release): dispatch deploy/dist workflows after
 sync-main push

GITHUB_TOKEN pushes do not emit push events, so deploy-configurator.yml
and publish-dist.yml were never triggered by the sync-main commit.
This caused the configurator and CDN bundles to always show the previous
release version rather than the newly released one.

Fix: after a successful push to main, explicitly dispatch both downstream
workflows via the workflow_dispatch API, which GITHUB_TOKEN is permitted
to trigger.

https://claude.ai/code/session_01N4PS78g7vyvyQwyzivoiuu
---
 .github/workflows/release.yml | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aaee0053..e7561686 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -141,10 +141,11 @@ jobs:
   # token — so an `on: release` workflow would never fire. The tag push that
   # triggers THIS workflow is a real event, so syncing here always runs.
   #
-  # The sync commit intentionally OMITS [skip ci]: changing the version must
-  # re-trigger publish-dist.yml so the `dist` branch bundles are rebuilt with
-  # the correct version header. The push targets main (a branch), which does
-  # not re-trigger this tag-scoped workflow, so there is no loop.
+  # NOTE: pushes made with GITHUB_TOKEN do NOT trigger push-based workflow
+  # events (deploy-configurator.yml, publish-dist.yml). After pushing, we
+  # explicitly dispatch both via workflow_dispatch (which GITHUB_TOKEN CAN
+  # trigger) so the configurator and dist branch are rebuilt with the correct
+  # version stamp.
   sync-main:
     name: Sync version artifacts to main
     needs: release
@@ -181,6 +182,7 @@ jobs:
       - name: Promote ## Unreleased in CHANGELOG to versioned heading
         run: node scripts/changelog-release.js "${{ steps.ver.outputs.tag }}"
       - name: Commit and push if anything changed
+        id: commit_push
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -189,9 +191,27 @@ jobs:
           git add package.json package-lock.json docs/roadmap.md CHANGELOG.md
           if git diff --cached --quiet; then
             echo "Nothing to commit — version artifacts on main already match ${{ steps.ver.outputs.tag }}."
+            echo "pushed=false" >> "$GITHUB_OUTPUT"
           else
             git commit -m "chore: sync version artifacts to ${{ steps.ver.outputs.tag }}"
             git push \
               "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
               HEAD:main
+            echo "pushed=true" >> "$GITHUB_OUTPUT"
           fi
+      - name: Trigger downstream deploys
+        if: steps.commit_push.outputs.pushed == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # GITHUB_TOKEN pushes do not emit push events, so deploy-configurator
+          # and publish-dist would never see the new version. Dispatch them
+          # explicitly — GITHUB_TOKEN CAN trigger workflow_dispatch events.
+          for wf in deploy-configurator.yml publish-dist.yml; do
+            curl -sS -f -X POST \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              -H "Accept: application/vnd.github.v3+json" \
+              "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/${wf}/dispatches" \
+              -d '{"ref":"main"}'
+            echo "Dispatched ${wf}"
+          done

From 0552704de4ae29e1e21502ad4c6ec99fd2fcb15e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 13 Jun 2026 14:01:09 +0000
Subject: [PATCH 2/2] fix(release): add actions:write and use gh CLI for
 workflow dispatch

- Add `actions: write` to sync-main job permissions so GITHUB_TOKEN is
  authorised to call the workflow_dispatch REST endpoint (without it the
  curl/gh call returns 403).
- Replace curl loop with two independent `gh workflow run` calls:
  each dispatch is its own statement so a failure in one does not abort
  the other, and gh provides clearer error messages than raw curl.

https://claude.ai/code/session_01N4PS78g7vyvyQwyzivoiuu
---
 .github/workflows/release.yml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7561686..e282715b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -152,6 +152,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      actions: write
     steps:
       - name: Checkout main
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
@@ -206,12 +207,10 @@ jobs:
         run: |
           # GITHUB_TOKEN pushes do not emit push events, so deploy-configurator
           # and publish-dist would never see the new version. Dispatch them
-          # explicitly — GITHUB_TOKEN CAN trigger workflow_dispatch events.
-          for wf in deploy-configurator.yml publish-dist.yml; do
-            curl -sS -f -X POST \
-              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-              -H "Accept: application/vnd.github.v3+json" \
-              "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/${wf}/dispatches" \
-              -d '{"ref":"main"}'
-            echo "Dispatched ${wf}"
-          done
+          # explicitly — GITHUB_TOKEN CAN trigger workflow_dispatch (actions:write
+          # permission granted above). Each call is independent so one failure
+          # does not prevent the other from running.
+          gh workflow run deploy-configurator.yml --ref main
+          echo "Dispatched deploy-configurator.yml"
+          gh workflow run publish-dist.yml --ref main
+          echo "Dispatched publish-dist.yml"