Our release workflow tagged three versions that were never published

Описание и применение

Три версии SDK были помечены и объявлены, но не опубликованы в npm, из‑за чего пользователи не могли их установить. Причина – использование токена GITHUB_TOKEN, который не запускает новые рабочие процессы. После замены токена на токен GitHub App и добавления шага публикации в основной workflow проблема решена.

Задача

Three SDK releases were tagged and announced but never published to npm, leaving users unable to install them.

Результат

The root cause was the use of a personal access token that authenticated as a person, allowing the release workflow to trigger the publish workflow. Switching to GITHUB_TOKEN prevented the second workflow from running. The fix involved adding the publish step to the first workflow, using a GitHub App token for cross‑workflow triggers, and implementing checks to ensure packages exist on npm.

Рабочий процесс

• 1. Merge to main triggers first workflow. 2. First workflow calculates next version, tags repo, creates GitHub release. 3. Second workflow should trigger on release event, build package, publish to npm. 4. Issue: GITHUB_TOKEN does not trigger workflows, so second workflow never ran. 5. Manual publication of missing versions from tags. 6. Updated workflow: publish step added to first workflow with needs, uses short‑lived GitHub App token for cross‑workflow trigger. 7. Final step fetches version from npm and fails if absent. 8. Daily job compares tags with npm registry and opens issue for missing packages.

Доказательства

The first workflow kept working. Tags appeared, releases appeared, the run was green. The second workflow never ran again, and nothing anywhere said so.

Источник

GitHub documents this: events caused by the GITHUB_TOKEN do not start new workflow runs, with the exception of workflow_dispatch and repository_dispatch.

Источник

We published the three versions by hand that afternoon, from their tags.

Источник

Publishing is now a job in the same workflow as the release, joined with needs, so it cannot be skipped without the release run itself showing as failed.

Источник