fix(action)!: honour dry-run, Node 24, and caller tokens; refresh action.md by goosewobbler · Pull Request #752 · goosewobbler/releasekit

goosewobbler · 2026-10-23T19:40:37Z

Fixes #738

Breaking: the action fails when dry-run: true is set with standing-pr-update, standing-pr-publish or refresh-after-release, which used to ignore it and run for real. node-version defaults to 24 (was 20), whose npm supports OIDC trusted publishing; pass node-version: '22' to stay on 22. Pass a PAT or App token as github-token; GITHUB_TOKEN in the step's env is ignored, as before.

Made with Cursor

Confidence Score: 5/5

The PR appears safe to merge, with non-blocking documentation and test gaps remaining.

Findings

Dry-run safeguards lack test coverage ▶
Empty-token fallback lacks test coverage ▶

Summary

The PR updates the action's runtime, credentials, dry-run safeguards, and documentation.

Backfill stays in preview mode, and unsupported modes reject dry-run.
Action workflows can choose API tokens, keep npm credentials, and run Node 22.
The action guide and language examples now match the available modes.

_{Reviews (2) · Last reviewed commit: "docs(action): clarify skip-checkout skip..." · Reviewed by Greptile}

…on.md Fixes #738 Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-10-23T19:43:16Z

Standing release PR: #730 · v0.42.1 queued (4 packages) · open 8h 49m · ✅ ready to merge

Release Preview — v0.42.0 → v0.42.1

Note: Labels on this PR are advisory in standing-pr mode. Bumps come from conventional commits in the standing PR; override by editing labels on the standing PR itself. Add release:immediate to bypass the standing PR and release this PR directly.

These changes will be added to the release PR (#730) when merged:

Changelog

monorepo 0.42.0 → 0.42.1

Changed

warn that the Actions PR toggle also grants approvals (ci) (PR #758)

say that publishOrder turns off the crate dependency sort (rust) (PR #787)

cover jsonOutput when disabled; fix inverted guard test (version) (PR #754 · closes #725)

drop versionCalculator tests that mocked a missing helper (version) (PR #755 · closes #726)

link standing-pr.yml comments to published ci-setup URLs (templates) (PR #756 · closes #728)

finish the #738 action reference; allow dry-run in gate mode (action)

clarify skip-checkout skips checkout only (action)

Fixed

default node-version to 24 (action)

describe publish order and partial-failure recovery by mode (release) (PR #762)

read sync notes edits under the changelog key (release) (PR #761)

keep dependency order and branch-first push in per-package mode (publish) (PR #765)

report publish PipelineError partial output in --json (release) (PR #760)

report merge without publish as changed (release) (PR #748 · closes #724)

resolve relative --project-dir before loading config (version) (PR #757 · closes #698)

untagged-package warning matches resolved changelog range (version) (PR #749 · closes #727)

commit the standing PR's release branch with the PR title (release) (PR #729)

keep root changelog history when several packages release (notes) (PR #775 · closes #736)

honour dry-run, Node 22, and caller tokens; refresh action.md (action) (#738)

All packages → 0.42.1 (sync versioning)

@releasekit/version

@releasekit/notes

@releasekit/publish

@releasekit/release

After merge — predicted release

No version escalation — this PR's changes will be included in the queued release without affecting the projected versions.

Package	Standing PR	This PR	After merge
`monorepo`	0.42.1	0.42.1	0.42.1

Updated automatically by ReleaseKit

greptile-apps · 2026-10-23T19:44:17Z

+  it('should reject dry-run for standing-pr-publish', () => {
+    expect(() => assertDryRunSupported('standing-pr-publish', 'true')).toThrow(/dry-run is not supported/);
+  });


Dry-run safeguards lack test coverage

The new test calls assertDryRunSupported directly, but never checks its connection to parseInputs or the backfill fix. Add tests that reject unsupported modes through parseInputs and confirm that dry-run: true removes --apply even when apply: true. Otherwise, either safeguard can disappear while this test stays green.

Fixed in 5dbf783: the guard is now tested through parseInputs for each rejected mode (and gate, which is read-only, is accepted), and a backfill test checks dry-run: true drops --apply even with apply: true.

greptile-apps · 2026-10-23T19:44:17Z

  }

-  const token = process.env.NPM_TOKEN ?? process.env.NODE_AUTH_TOKEN;
+  const token = process.env.NPM_TOKEN || process.env.NODE_AUTH_TOKEN;


Empty-token fallback lacks test coverage

The existing token tests use a nonempty NPM_TOKEN, so they pass with both ?? and || and do not protect this fix. Add a regression test with an empty NPM_TOKEN and a valid NODE_AUTH_TOKEN. Check both the generated .npmrc and the returned NODE_AUTH_TOKEN so this authentication failure cannot return unnoticed.

Fixed in 5dbf783: added a test with an empty NPM_TOKEN and a set NODE_AUTH_TOKEN, checking both the returned env and the generated .npmrc. It fails with ??.

Co-authored-by: Cursor <cursoragent@cursor.com>

goosewobbler · 2026-10-23T20:00:50Z

@greptile review

… mode Finishes the docs items #738 listed and the PR hadn't covered: - the versioning section is folded into the pinning note, which now says vX.Y.Z tags move and to pin the commit one points to; - inputs stable, scope and ssh-key, `bump: prerelease`, and the gate and standing-PR outputs are documented, as is that release outputs need json; - permissions for gate and the standing-PR modes; - the examples drop the ignored `env: GITHUB_TOKEN`, the preview trigger includes label events, and the dry-run example passes the markdown through env instead of interpolating PR text into shell; - README no longer promises rollout guidance. Gate is read-only, so dry-run is now accepted there instead of failing. Tests drive the dry-run guard through parseInputs, cover backfill dropping --apply on a dry run, and cover an empty NPM_TOKEN falling back to NODE_AUTH_TOKEN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The action's own setup-node replaces any Node version an earlier step set up, so its default is what the publish runs on. Node 22 bundles npm 10, and npm trusted publishing needs npm 11.5.1 or later, which ships with Node 24. This repo's own release job, the examples and ci-setup already use 24. Callers can still pass node-version: '22'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(action): honour dry-run, Node 22, and caller tokens; refresh acti…

b878f44

…on.md Fixes #738 Co-authored-by: Cursor <cursoragent@cursor.com>

greptile-apps Bot reviewed Oct 23, 2026

View reviewed changes

docs(action): clarify skip-checkout skips checkout only

817ab92

Co-authored-by: Cursor <cursoragent@cursor.com>

goosewobbler changed the title ~~fix(action): honour dry-run, Node 22, and caller tokens; refresh action.md~~ fix(action)!: honour dry-run, Node 22, and caller tokens; refresh action.md Oct 23, 2026

goosewobbler changed the title ~~fix(action)!: honour dry-run, Node 22, and caller tokens; refresh action.md~~ fix(action)!: honour dry-run, Node 24, and caller tokens; refresh action.md Oct 24, 2026

goosewobbler mentioned this pull request Oct 24, 2026

Docs accuracy: ci-setup.md and examples/ci READMEs #745

Open

30 tasks

Navigation Menu

Repository navigation

fix(action)!: honour dry-run, Node 24, and caller tokens; refresh action.md - #752

fix(action)!: honour dry-run, Node 24, and caller tokens; refresh action.md#752
goosewobbler wants to merge 4 commits into
mainfrom
fix/738-action-dry-run-tokens-docs

goosewobbler commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Changelog

Changed

Fixed

After merge — predicted release

Uh oh!

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

goosewobbler Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

goosewobbler Oct 23, 2026

Uh oh!

goosewobbler commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

goosewobbler commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Changed

Fixed

After merge — predicted release

Uh oh!

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

goosewobbler Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

goosewobbler Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

goosewobbler commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

goosewobbler commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading