From c176e969a2864184d00acf9f128ec02a66b0f4bf Mon Sep 17 00:00:00 2001 From: Till Hoffmann Date: Fri, 31 Jul 2026 20:24:32 +0200 Subject: [PATCH] fix(ci): inherit secrets into the release workflow, serialize tag-on-main Observed on temingo v3.0.5: release succeeded, run went red, because the homebrew tap step got an empty GH_TOKEN. A called workflow receives no secrets unless the caller passes them. Third instance of the workflow_call path diverging from `on: push: tags:`. Also adds a concurrency group. Two merges in quick succession would run in parallel, both read the same `git describe` tag and compute the same next version - one tag push wins, the other fails. Not cancel-in-progress: a cancelled run leaves a tag whose release never happened. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/tag-on-main.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/tag-on-main.yaml b/.github/workflows/tag-on-main.yaml index 2a65c23..abbd306 100644 --- a/.github/workflows/tag-on-main.yaml +++ b/.github/workflows/tag-on-main.yaml @@ -5,6 +5,14 @@ on: branches: - main +# Two merges in quick succession would otherwise run in parallel, both read the +# same `git describe` tag, and compute the same next version - one tag push wins +# and the other fails. Serialize instead, and never cancel: a cancelled run +# leaves a tag whose release never happened. +concurrency: + group: tag-on-main + cancel-in-progress: false + jobs: determine-version: runs-on: ubuntu-latest @@ -85,6 +93,10 @@ jobs: contents: write packages: write uses: ./.github/workflows/release-golang-executable-on-tag.yaml + # A called workflow receives no secrets unless they are passed. Without this + # HOMEBREW_TAP_ACCESS_TOKEN is empty and the tap update fails after a + # successful release - observed on temingo v3.0.5. + secrets: inherit with: tag: ${{ needs.determine-version.outputs.NEW_VERSION }} # These releases get no CHANGELOG entry: the commit adding it could not