From 8100734b1ce25b2ce5f21211fb745d01240114da Mon Sep 17 00:00:00 2001 From: Peter Corke Date: Thu, 13 Aug 2026 13:36:12 +1000 Subject: [PATCH] fix(ci): guard release-please's PyPI-publish trigger against the truthy-string bug steps.release.outputs.releases_created is always the literal string "true" or "false" (release-please-action stringifies a JS boolean via core.setOutput), never unset. Only "" is falsy in an if: expression, so the bare output reference fired the trigger on every push to main, not just when a release was actually created -- confirmed live: it fired after PR #73 merged (a non-release push) and dispatched release.yml against the already-published v2.2.0 tag. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release-please.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 5b8ff6a6..1f6a3566 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -31,8 +31,14 @@ jobs: # `pypi` deploy environment's protection rules only allow deploys # from refs matching `v*` (a tag), so `--ref main` gets rejected at # the publish step even though build/smoke-test pass. + # release-please-action always sets releases_created to the literal + # string "true"/"false" (core.setOutput stringifies a JS boolean) -- + # never unset. In an `if:` expression only "" is falsy, so a bare + # `${{ steps.release.outputs.releases_created }}` is truthy on every + # push, not just when a release was actually created. Must compare + # explicitly against the string 'true'. - name: Trigger PyPI publish - if: ${{ steps.release.outputs.releases_created }} + if: ${{ steps.release.outputs.releases_created == 'true' }} run: | tag=$(gh release list --repo "$GH_REPO" --limit 1 --json tagName -q '.[0].tagName') gh workflow run release.yml --repo "$GH_REPO" --ref "$tag"