Describe what the release workflow actually does - #6
Merged
Conversation
Three claims in its header were wrong, and they are the kind that mislead whoever is cutting the release. It listed the npm tarball under "Assets produced". The tarball is a workflow artifact and the input to the publish job; it is not attached to the release, which carries three assets, not five. It said the tarball was "published by the npm job". Publishing needs an NPM_TOKEN secret this repo does not have, so the step is skipped and the job still reports success — a green release does not mean the package went out. 1.1.1 and 1.1.2 were both published by hand for exactly this reason, and the comment gave no hint that they would have to be. The header now says so and gives the command. The tag example named v1.1.0, two releases ago. It is vX.Y.Z now, which cannot go stale. Also records the guarantee added in 1.1.2 — the finished image is checked for build-host paths and for its bundled CLI — so the list of fail-loud checks matches the steps that exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three claims in the workflow's header were wrong — the kind that mislead whoever is cutting the release. They misled me twice this session.
tokenflow-<version>.tgz + .sha256under "Assets produced"NPM_TOKENsecret, and the job still reports successgit tag v1.1.0 && git push origin v1.1.0The npm one matters most: a green release does not mean the package went out. 1.1.1 and 1.1.2 were both published by hand for exactly this reason, and nothing in the file hinted that they would have to be. The header now says so and gives the command.
The tag example is
vX.Y.Z, which cannot go stale — same treatment as the demo page's version and the diagnostics version string.Also records the guarantee added in 1.1.2 (the finished image is checked for build-host paths and for its bundled CLI), so the fail-loud list matches the steps that exist.
Comment-only; no workflow behaviour changes.
🤖 Generated with Claude Code