Consolidate auto-tag.yml + release.yml; drop PAT requirement - #2
Merged
Conversation
The previous two-workflow shape (auto-tag.yml -> push tag -> release.yml)
needed a PAT because GITHUB_TOKEN-pushed tags don't trigger downstream
workflow runs (anti-recursion safety). Fold everything into a single
workflow triggered by:
- push to main touching Applications/TextMate/about/Changes.md
- workflow_dispatch
The workflow extracts the version from the top entry of Changes.md,
early-exits on non--undead versions, and skips when the tag already
exists. Only -undead releases gated past these checks pay for the
macos-14 minutes. The final step uses `gh release create v${VERSION}
--target ${GITHUB_SHA}` to create the tag + release atomically through
the default ${{ github.token }} — no PAT, no secret to rotate.
Resolves the chicken-and-egg requirement for RELEASE_PAT in repo secrets.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fold
auto-tag.ymlintorelease.ymlso the entire release flow runs in one workflow triggered directly by edits toApplications/TextMate/about/Changes.md. Drops the chicken-and-egg PAT requirement.Background
The previous two-workflow shape:
auto-tag.yml— push to main → readChanges.md→ push tagrelease.yml— push tag → build/sign/notarize/releaseneeded a PAT in the first workflow because tags pushed by
GITHUB_TOKENdon't trigger downstream workflow runs (GitHub Actions anti-recursion safety). That's the only reasonRELEASE_PATwas a required secret.The cleaner pattern (e.g. dayglojesus/cloudsap's
build-and-release.yml): a single workflow onpush: branches: [main], paths: [<version-file>]does the version detect, the tag creation, and the release in sequence.gh release create v${VERSION} --target ${GITHUB_SHA}makes the tag and the release atomically — through${{ github.token }}. No PAT, no secret to rotate.What changes
.github/workflows/auto-tag.yml(60 lines)..github/workflows/release.ymlrestructured:on: push: branches: [main], paths: [Applications/TextMate/about/Changes.md]+workflow_dispatch.Changes.md→ guard on-undeadsuffix → guard on tag-already-exists.steps.tagcheck.outputs.should_release == 'true'. Non-undeadChanges.mdedits early-exit in seconds.gh release create "v${VERSION}" --target "${GITHUB_SHA}" --title "TextMate ${VERSION}" --generate-notes "${ARCHIVE}".GH_TOKEN: ${{ github.token }}— no PAT anywhere.After this merges
The
RELEASE_PATrepo secret can be deleted. Releases are cut by PRing a## YYYY-MM-DD (vX.Y.Z-undead)block to the top ofChanges.mdand merging.Test plan
Changes.mdto a non--undeadplaceholder; merge to a fork branch; verify the workflow exits at the-undeadguard without burning macos-14 minutes.-undeadbump triggers full build/sign/notarize/release path.