From 3d785c4f1b270ac66d6b053b5ac5c1e6c6c0be59 Mon Sep 17 00:00:00 2001 From: Daniel Date: Tue, 10 Nov 2026 19:28:49 +0100 Subject: [PATCH] ci: check out the repository in the registry publish job The release action uploads the icon and screenshots that emdash-plugin.jsonc lists under release.artifacts, and reads both from the working directory. The publish job only downloaded the bundle, so releases reached the registry without listing images. The checkout runs first, because it cleans the workspace and would remove a bundle downloaded before it. Closes #36 --- .github/workflows/emdash-release.yml | 8 ++++++++ AGENTS.md | 4 +++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/emdash-release.yml b/.github/workflows/emdash-release.yml index 9783e25..0ba5b65 100644 --- a/.github/workflows/emdash-release.yml +++ b/.github/workflows/emdash-release.yml @@ -140,6 +140,14 @@ jobs: id-token: write # Required for the audience-bound GitHub OIDC token. attestations: write # Required to sign build provenance. steps: + # The release action reads emdash-plugin.jsonc and uploads the listing + # images it names. First, because a checkout cleans the workspace and + # would remove a bundle downloaded before it. + - name: "Check out repository" + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: "Download the bundle" uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: diff --git a/AGENTS.md b/AGENTS.md index 512b953..d67b262 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -111,7 +111,9 @@ npmjs.com changes too. The registry profile names the repository as well After an npm publish it calls `emdash-release.yml`, generated by `emdash-plugin release setup` and edited since, which publishes the same version to the EmDash registry. Its build and publish run in separate jobs; only the publish job -holds `id-token`, and it installs and builds nothing. The npm publish job +holds `id-token`, and it installs and builds nothing: it checks the +repository out only so the release action can read `emdash-plugin.jsonc` and +the listing images it names. The npm publish job runs in the `npm` environment, which the npm trusted publisher requires. Keep both.