Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -91,3 +91,32 @@ jobs:
- name: Publish to npm
if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
run: npm publish --tag latest

github-release:
needs: [npm-publish-latest]
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
permissions:
contents: write
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Create GitHub release with generated notes
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
TAG="v$(node -p "require('./package.json').version")"
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TAG assignment uses nested double-quotes (TAG="v$(node -p "require('./package.json').version")"), which will be parsed incorrectly by bash and fail before the release logic runs. Use single-quotes around the Node expression or otherwise escape the inner quotes so the command substitution is valid.

Suggested change
TAG="v$(node -p "require('./package.json').version")"
TAG="v$(node -p 'require("./package.json").version')"

Copilot uses AI. Check for mistakes.

if gh release view "$TAG" >/dev/null 2>&1; then
echo "Release $TAG already exists. Skipping."
exit 0
fi

if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
echo "Tag $TAG already exists on origin. Creating release from existing tag."
gh release create "$TAG" --verify-tag --generate-notes
else
echo "Creating tag and release $TAG from commit $GITHUB_SHA."
gh release create "$TAG" --target "$GITHUB_SHA" --generate-notes
Comment on lines +117 to +121
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the tag already exists on origin, this creates the release from that tag without confirming it points to the same commit that was just published to npm. If refs/tags/$TAG targets a different commit than $GITHUB_SHA, this can produce a GitHub release whose code/release notes don’t match the published package. Consider verifying the tag’s target commit matches $GITHUB_SHA (and failing if it doesn’t) before creating the release.

Copilot uses AI. Check for mistakes.
fi
Loading