diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 037835a..16d66e9 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -5,7 +5,6 @@ on: branches: [main] push: branches: [main] - workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml index c41b3d8..758e597 100644 --- a/.github/workflows/publish-package.yml +++ b/.github/workflows/publish-package.yml @@ -9,7 +9,6 @@ concurrency: cancel-in-progress: false permissions: - actions: write contents: write pull-requests: write packages: write @@ -126,7 +125,6 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404 needs: resolve-merge-context permissions: - actions: write contents: write pull-requests: write packages: write @@ -318,22 +316,3 @@ jobs: - Next stable version prepared: `${{ steps.meta.outputs.next_stable_version }}` add-paths: | package.json - - - name: Trigger required checks for bump PR - if: steps.meta.outputs.create_bump_pr == 'true' - env: - GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }} - REPO: ${{ github.repository }} - BUMP_BRANCH: ci/version-bump-${{ steps.meta.outputs.next_stable_version }} - BUMP_TITLE: "chore: bump package version to ${{ steps.meta.outputs.next_stable_version }}" - run: | - gh api \ - --method POST \ - "repos/${REPO}/actions/workflows/check.yml/dispatches" \ - -f ref="${BUMP_BRANCH}" - - gh api \ - --method POST \ - "repos/${REPO}/actions/workflows/validate-pr-title.yml/dispatches" \ - -f ref="${BUMP_BRANCH}" \ - -F inputs[pr_title]="${BUMP_TITLE}" diff --git a/.github/workflows/validate-pr-title.yml b/.github/workflows/validate-pr-title.yml index f3e31f3..df3e0a2 100644 --- a/.github/workflows/validate-pr-title.yml +++ b/.github/workflows/validate-pr-title.yml @@ -3,12 +3,6 @@ name: ValidatePrTitle on: pull_request: types: [opened, edited, synchronize, reopened] - workflow_dispatch: - inputs: - pr_title: - description: "Pull request title to validate" - required: true - type: string permissions: pull-requests: read @@ -20,7 +14,7 @@ jobs: steps: - name: Validate pull request title env: - PR_TITLE: ${{ github.event_name == 'pull_request' && github.event.pull_request.title || inputs.pr_title }} + PR_TITLE: ${{ github.event.pull_request.title }} run: | title="${PR_TITLE}" if [ -z "${title// /}" ]; then diff --git a/RELEASE.md b/RELEASE.md index e864186..2ac917d 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -28,14 +28,11 @@ Workflow: `.github/workflows/publish-package.yml` ## Required Repository Configuration - GitHub Actions: - - `GITHUB_TOKEN` must keep `actions:write`, `contents:write`, `pull-requests:write`, `packages:write` permissions in `publish-package.yml`. + - `GITHUB_TOKEN` must keep `contents:write`, `pull-requests:write`, `packages:write` permissions in `publish-package.yml`. - Optional token: - `GH_PAT` can be set to let `create-pull-request` use a PAT instead of `GITHUB_TOKEN`. - - If `GH_PAT` is not available, publish automation dispatches `Check` and `ValidatePrTitle` workflows directly on the bump branch so required checks still attach to the bump PR head commit. - Branch governance: - Keep required checks enforced for PRs into `main`: - - `Check` - - `ValidatePrTitle` - `CodeQL` ## Verify Current Published State