fix(ci): add tag trigger, normalize v-prefix#250
Merged
Conversation
📝 WalkthroughWalkthroughAdds a ChangesPublish and release workflow updates
Sequence Diagram(s)sequenceDiagram
participant workflow_dispatch as workflow_dispatch input
participant preflight as preflight job
participant pyproject as pyproject.toml
workflow_dispatch->>preflight: provide `version` / `dry-run` or trigger via tag
preflight->>preflight: resolve VERSION (strip leading v if push)
preflight->>pyproject: compare resolved VERSION with pyproject.toml
preflight-->>preflight: set preflight.outputs.version
sequenceDiagram
participant publish as publish job
participant pypi as PyPI
participant git as git remote
participant github as GitHub Release API
publish->>pypi: check for existing artifacts for $VERSION
alt artifacts not present and !inputs.dry-run
publish->>pypi: upload packages for $VERSION
publish->>pypi: verify packages available for $VERSION
end
alt github.event_name != 'push' and !inputs.dry-run
publish->>git: create and push git tag $VERSION
end
alt !inputs.dry-run
publish->>github: create GitHub release for $VERSION
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 4-5: The on.push.tags glob is wrong: replace the regex-like
pattern with a shell-style glob that matches optional leading "v", major 0, and
two numeric segments; update the tags entry in .github/workflows/publish.yml
(the on.push.tags key) to use a glob such as "v?0.*.*" so tag-triggered
publishing catches "0.x.y" and "v0.x.y".
- Around line 30-39: The Resolve step uses untrusted inputs.version directly in
a shell assignment which can lead to command injection; update the resolve step
(id: resolve) to sanitize and validate inputs.version before use (e.g., strip
any non-semver characters, reject or normalize strings containing shell
metacharacters like `$(...)`, backticks, `;`, `|`) and always write the output
using a safe writer like printf to $GITHUB_OUTPUT; ensure the logic in the
Resolve block that sets version when github.event_name != "push" uses the
sanitized/validated variable and falls back or fails fast on invalid values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3a3c82b5-1d37-4e65-9e60-a08e182cb041
📒 Files selected for processing (2)
.github/workflows/publish.ymldocs/content/docs/more/changelog.mdx
pratyush618
force-pushed
the
fix/publish-workflow-overhaul
branch
from
June 12, 2026 02:34
8776434 to
101e02a
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/publish.yml (1)
27-47:⚠️ Potential issue | 🟠 MajorPreserve the original git tag name when creating the GitHub Release
On tag
push,Resolve versionstrips the leadingvand only exports the normalizedversion, andgh release create "$VERSION"then creates the release underX.Y.Zinstead of the triggeringvX.Y.Z(e.g.,v0.16.1-> release/tag0.16.1). The non-push duplicate check also only looks forrefs/tags/${version}, notrefs/tags/v${version}, so the two accepted spellings aren’t treated as the same identity.Suggested fix
preflight: outputs: version: ${{ steps.resolve.outputs.version }} + release_tag: ${{ steps.resolve.outputs.release_tag }} steps: - name: Resolve version id: resolve env: VERSION_INPUT: ${{ inputs.version }} run: | if [ "${{ github.event_name }}" = "push" ]; then - version="${GITHUB_REF_NAME#v}" + release_tag="${GITHUB_REF_NAME}" + version="${release_tag#v}" else version="${VERSION_INPUT}" version="${version#v}" + release_tag="${version}" fi if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "::error::Invalid version format: ${version}" exit 1 fi printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT" + printf 'release_tag=%s\n' "$release_tag" >> "$GITHUB_OUTPUT" - name: Check tag does not exist if: github.event_name != 'push' run: | version="${{ steps.resolve.outputs.version }}" - if git ls-remote --tags origin | awk -v tag="refs/tags/${version}" '$2 == tag { found=1 } END { exit !found }'; then - echo "::error::Tag ${version} already exists on remote" + if git ls-remote --tags origin | awk -v tag="refs/tags/${version}" -v vtag="refs/tags/v${version}" '$2 == tag || $2 == vtag { found=1 } END { exit !found }'; then + echo "::error::A tag for ${version} already exists on remote" exit 1 fi publish: env: VERSION: ${{ needs.preflight.outputs.version }} + RELEASE_TAG: ${{ needs.preflight.outputs.release_tag }} - name: Create GitHub release if: "!inputs.dry-run" env: GH_TOKEN: ${{ github.token }} run: | - gh release create "$VERSION" \ + gh release create "$RELEASE_TAG" \ --title "v${VERSION}" \ --generate-notes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c5d9250a-aa1b-43cd-8faf-e111a234373a
📒 Files selected for processing (1)
.github/workflows/publish.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
push: tagstrigger alongsideworkflow_dispatch— pushing a tag now triggers publishvprefix: accepts both0.16.1andv0.16.1Test plan
workflow_dispatchwithv0.16.1→ normalizes to0.16.1, full pipelinegit push origin 0.16.1→ tag trigger, skips tag creation stepSummary by CodeRabbit
New Features
Chores