fix(release): stop referencing env context in environment: block - #26
Conversation
jobs.<id>.environment.name/url only resolve github, inputs, vars,
needs, secrets, strategy, and matrix contexts - env isn't one of
them. GitHub Actions rejected the whole file at parse time
("Unrecognized named-value: 'env'"), which is a startup failure that
happens before trigger filtering, so it fired (and failed with zero
jobs) on every push, not just tag pushes.
Also add workflow_dispatch so a missed/failed tag publish can be
re-run manually without tag surgery.
…ease.yml startup failure
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c836b32424
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| push: | ||
| tags: | ||
| - "v*.*.*" | ||
| workflow_dispatch: |
There was a problem hiding this comment.
When a maintainer dispatches this workflow from a branch admitted by the pypi environment, every job still runs: the branch artifact is published with an OIDC token, and gh release create later uses the branch name from github.ref_name. This bypasses the documented invariant that releases run only for v*.*.* tags and can publish an untagged commit or create a release named after a branch; guard manual runs with a tag-ref check or accept and validate an explicit release tag.
AGENTS.md reference: AGENTS.md:L17-L17
Useful? React with 👍 / 👎.
1 participant
Intent
release.ymlso it stops startup-failing on every push (zero jobs,Invalid workflow fileat parse time) and can actually publishv0.10.1to PyPI.jobs.publish-to-pypi.environment.name/urlreferenced${{ env.ENVIRONMENT_NAME }}/${{ env.PYPI_PROJECT_URL }}, but theenvironment:block's expression context doesn't resolveenv(onlygithub,inputs,vars,needs,secrets,strategy,matrixare valid there). GitHub rejected the whole file at parse time withUnrecognized named-value: 'env'- a startup failure that happens before trigger filtering applies, which is why it also fired (and failed) on plain branch pushes despite theon:block being tags-only.environment.name/urlinstead of theenvindirection.env.PYTHON_VERSIONelsewhere is untouched sincerun:steps do resolveenvfine.workflow_dispatchas a manual re-run trigger, so a tag whose run failed to publish (likev0.10.1here) doesn't need tag surgery to retry.attestationssetting (already enabled, matching ci(release): make release.yml the top-level publish workflow #22's reasoning) unchanged.