fix(actions): publish through the REST API, not the gh CLI - #86
Merged
Conversation
gh is preinstalled on GitHub-hosted runners but is not part of the runner, so on a self-hosted runner without it both publishing actions failed at the upload step, after the artifact had already been built. Every gh invocation — release lookup, `gh release upload --clobber`, the repository_dispatch notify — now runs through actions/github-script and the Octokit client it provides, in one shared module, actions/lib/release.cjs. The runner needs nothing preinstalled beyond bash for the two one-line run: steps; Node comes from setup-node. Uploads go to the release's own upload_url rather than a hard-coded uploads.github.com, so GitHub Enterprise hosts work as well. Consumer-controlled values still flow through env, never into the script body (#55). The reusable build workflow now defaults GITHUB_TOKEN to github.token when docs-token is omitted, so fetch-apps.js never falls back to gh in CI; the fallback itself now says what to do when gh is missing instead of printing "failed: undefined". release.selftest.js pins the API calls and their order against a recording fake client and is part of `npm run selftest`. Closes #85 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
The reasoning belongs in the comment itself; a tracker reference is one more thing that goes stale. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #85
Problem
Both shared composite actions shelled out to
ghfor the release lookup,gh release upload --clobberand therepository_dispatchnotify.ghis preinstalled on GitHub-hosted runners but is not part of the runner, so a self-hosted runner without it failed at the upload step, after the artifact had already been built.Change
actions/lib/release.cjs(new) — release lookup, clobber-upload and notify via the Octokit clientactions/github-scriptprovides. Zero dependencies; CommonJS becausegithub-scripthands scripts arequire. Uploads go to the release's ownupload_url, so GitHub Enterprise upload hosts work without configuration.action.ymls — upload and notify steps are nowactions/github-script@v9.0.0(SHA-pinned) loading that module. Consumer-controlled values still flow throughenv, never into the script body (Hardening: publish-single-page-docs interpolates step outputs directly into a run: block #55). The onlyrun:steps left arenpm ciand the entry point.build-image.yml—GITHUB_TOKENdefaults togithub.tokenwhendocs-tokenis omitted, sofetch-apps.jsnever falls back toghin CI. The fallback itself now says what to do whenghis missing instead of printingfailed: undefined.contract/DEPLOYMENT.md— "Runner requirements" sections.actions/lib/release.selftest.js— pins the API calls and their order against a recording fake client (tag resolution order, delete-before-upload, upload URL/headers, error messages, non-404 errors propagate, notify warns and never fails). Part ofnpm run selftest, so CI's actions job runs it.Behaviour change worth knowing
Previously any API error during the tag lookup (e.g. a 403 from a token without
contents: write) was swallowed and surfaced as "no GitHub Release". A non-404 error now propagates with its real cause.Verification
npm run selftestgreen (both actions + the new release checks)yamlpackage CI usesghleft outside comments inactions/**/action.ymlv1.🤖 Generated with Claude Code
https://claude.ai/code/session_01PYtmxSeSXFg4wEXRcKCmAi