[trsdn]

Follow-up to #52. That PR's least-privilege permissions work in pre-release.yml is good and stays untouched — this only reverts the three tag guards it added to release.yml.

The problem

#52 added to publish, create-github-release and post-release-validation:

if: startsWith(github.ref, 'refs/tags/')

with the rationale that "a manual workflow_dispatch run is a dry run of build + quality gates". That is not what a dispatch means in this workflow:

workflow_dispatch:
  inputs:
    tag:
      description: 'Existing release tag to (re-)run the pipeline for, e.g. v1.2.3'
      required: true
      type: string

The input is required, and every job checks it out via ref: ${{ inputs.tag || github.ref }} (lines 39, 91, 148, 191, 290, 488). A dispatch is the documented way to re-run the pipeline for a tag that already exists.

On workflow_dispatch, github.ref is refs/heads/main, never refs/tags/*. So the guard was always false: publish was skipped, create-github-release was skipped, and the run still finished green. Failure that looks like success — the worst kind.

Why this matters concretely

v2.0.0 needed three attempts (21:56, 22:08, 22:12) because the mypy --strict gate failed on Python 3.12 over a PEP 695 type statement in the numpy stubs. A tag that exists with a half-finished pipeline is exactly the situation the dispatch re-run exists for. With the guard in place the only remaining option would be deleting and re-pushing the tag.

The risk it was meant to address is already covered

A duplicate upload cannot slip through, because validate-release runs:

- name: Check if tag already exists in releases
  run: |
    if gh release view "$TAG" >/dev/null 2>&1; then
      echo "❌ Release for tag $TAG already exists"
      exit 1
    fi

A re-run of a fully completed release fails early and loudly. A re-run of a half-failed one proceeds, which is the intent.

Changes

• Dropped the guard from all three jobs, replacing each comment with the reason it must not be there, so this does not get re-added a third time
• CHANGELOG.md entry under [Unreleased]

Validation

• actionlint: 7 shellcheck findings before, 7 after — all pre-existing in untouched jobs, none introduced
• Job conditions re-parsed from YAML:

  publish                 | needs.validate-release.outputs.is-prerelease == 'false'
  create-github-release   | always() && needs.validate-release.result == 'success' && ...
  post-release-validation | always()
  

• grep -c "startsWith(github.ref" .github/workflows/release.yml → 0

Note on the same guard elsewhere

In trsdn/obsidian-mcp I deliberately added this exact guard (PR #11). There workflow_dispatch has no tag input, so a dispatch would have published whatever version main held. Same line, opposite effect — what decides it is the trigger design of the individual workflow.

[github-actions]

🔍 CI Quality Gates Summary

Overall Status: ✅ All Passed

Check	Status	Details	Action Required
🎨 Format	✅ Passed	ruff format check	None
🔧 Lint	✅ Passed	ruff linting	None
📝 Types	✅ Passed	mypy type checking	None
🧪 Tests	✅ Passed	Unit tests	None
📊 Coverage	81.8%	Minimum: 80%	None
🔌 MCP	✅ Valid	Protocol compliance	None
🔒 Security	✅ Clean	Dependency audit	None

🔗 Quick Links

• View detailed analysis
• See workflow logs

🛠️ Quick Fix Commands

# Fix most issues automatically
ruff format .
ruff check . --fix

# Run tests locally
pytest tests/unit/ --cov=markitdown_mcp

# Check types
mypy markitdown_mcp

---

Last updated: 2026-08-24 22:48:31 UTC

[github-actions]

🔍 PR Quality Summary

CI Status

✅ Docs: success
✅ Security: success
✅ Quality: success

Metrics

Metric	Value	Trend
📊 Coverage	N/A	-
🧪 Tests	Test results unavailable	-
⏱️ Performance	No performance data	-

Quality Checks

• Format & Lint: Ruff formatting and linting
• Type Safety: MyPy strict type checking
• Security: Bandit, Safety, GitLeaks scanning
• MCP Protocol: Tool schema validation
• Documentation: Docstring coverage (80%+)

MCP Tools

• convert_file - Convert individual files to Markdown
• convert_directory - Batch convert directories
• list_supported_formats - Query supported file types

---

_{🤖 Auto-generated by CI • Last updated: 2026-08-24 22:48 UTC}