From 28c8420008b1c3f1317cdd8632a19a7bc878e20f Mon Sep 17 00:00:00 2001 From: Hugo Bjork Date: Mon, 7 Sep 2026 16:57:46 +0200 Subject: [PATCH] ci(publish): bypass main ruleset via deploy key for version-bump push The publish workflow died at 'git push --follow-tags' with GH013: the repo ruleset requires PRs for GITHUB_TOKEN pushes to main, so the bot could never push the npm version bump and 'npm publish' never ran (npm frozen at 2.2.21 despite green releases). Same fix as api/console/chat release.yml: check out with the repo Deploy Key (SSH secret DEPLOY_KEY), which bypasses the ruleset for the version-bump push. Key added as read-write deploy key + DEPLOY_KEY secret on this repo. --- .github/workflows/publish.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c770669..e4fe665 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,6 +15,8 @@ on: jobs: test: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@v4 @@ -37,12 +39,18 @@ jobs: publish: needs: test runs-on: ubuntu-latest + permissions: + contents: write steps: + # The repo ruleset requires PRs for GITHUB_TOKEN pushes to main. + # Checking out with the repo Deploy Key (SSH) makes the version-bump + # push below bypass the ruleset, same as api/console/chat release.yml. - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 ref: main + ssh-key: ${{ secrets.DEPLOY_KEY }} - name: Setup Node.js uses: actions/setup-node@v4