Skip to content

chore: don't persist git credentials on checkout in release workflow #16248

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
teemingc merged 1 commit into from
Jul 6, 2026
+1 −4
Merged

chore: don't persist git credentials on checkout in release workflow #16248

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,7 @@ jobs:
- name: Checkout Repo
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
fetch-depth: 0

@Andarist Andarist Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

driveby change: Changesets nowadays should auto-deepen a shallow clone

persist-credentials: false

@vercel vercel Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removal of fetch-depth: 0 from the release workflow checkout breaks Changesets changelog generation because it no longer has full git history.

Fix on Vercel

- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
Expand All @@ -44,8 +43,6 @@ jobs:
publish-script: pnpm changeset:release
version-script: pnpm changeset:version
github-token: ${{ secrets.GITHUB_TOKEN }}
env:
NPM_CONFIG_PROVENANCE: true
Comment on lines -47 to -48

@Andarist Andarist Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

driveby change: from what I understand, this really shouldn't be required anymore (it might have been in the past). We publish Changesets itself with provenance just fine and we don't need to specify any such environment variable.

@elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Andarist are you sure? This is set so that our packages are published with provenance -- it doesn't have anything to do with whether changesets is published with provenance.

@elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh wait. I totally misread your comment. I understand now. 😆

@pngwn pngwn Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This the default if you use trusted publishing i believe, which is why it isn't required.


# TODO alert discord
# - name: Send a Slack notification if a publish happens
Expand Down