fix(release): use git diff --cached in version bump step - #45
Merged
Conversation
…se workflow The 'Commit version changes and push' step used 'git diff --quiet', which compares the working tree to the index. After 'git add -A', the working tree and index are in sync, so diff --quiet exits 0 and the commit never happens. The version bump ran locally but was not pushed, and the publish step attempted to publish 1.2.0 without committing it. Use 'git diff --cached --quiet' to compare against HEAD instead. The commit will now be created on a real diff. This also surfaces a second symptom: if 'pnpm changeset version' modifies files, they will be staged for commit, but the tag will also need to be pushed. The current script does both 'git push origin HEAD' and 'git push --tags', which covers it once the commit is actually made. Adds a changeset to pass the new ci.yml lint.
martyy-code
added a commit
that referenced
this pull request
Aug 3, 2026
…ags) PR #45 fixed the missing version-bump commit but ENEEDAUTH persisted on the publish step. Trust on npmjs.com was tightened (no environment filter), but the workflow was still not signaling OIDC intent to pnpm. Three aligned changes, mirroring the proven pattern in our other release workflows: 1. Release workflow: node-version 22 -> 24. The runner already defaults to Node 24; pinning 22 was unnecessarily old and predates the npm CLI >= 11.5.1 + Node >= 22.14.0 trusted-publishing prerequisites. 2. 'Publish packages' step: add env NPM_CONFIG_PROVENANCE: 'true'. pnpm reads this and routes publish through OIDC, not the legacy fallback path that requires a token. 3. packages/errors/package.json: add publishConfig.provenance: true. Belt + suspenders alongside the env var, and gives npm a default intent for provenance attestation on every publish. Adds a changeset to pass the new ci.yml lint.
martyy-code
added a commit
that referenced
this pull request
Aug 3, 2026
…ags) PR #45 fixed the missing version-bump commit but ENEEDAUTH persisted on the publish step. Trust on npmjs.com was tightened (no environment filter), but the workflow was still not signaling OIDC intent to pnpm. Three aligned changes, mirroring the proven pattern in our other release workflows: 1. Release workflow: node-version 22 -> 24. The runner already defaults to Node 24; pinning 22 was unnecessarily old and predates the npm CLI >= 11.5.1 + Node >= 22.14.0 trusted-publishing prerequisites. 2. 'Publish packages' step: add env NPM_CONFIG_PROVENANCE: 'true'. pnpm reads this and routes publish through OIDC, not the legacy fallback path that requires a token. 3. packages/errors/package.json: add publishConfig.provenance: true. Belt + suspenders alongside the env var, and gives npm a default intent for provenance attestation on every publish. Adds a changeset to pass the new ci.yml lint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the release workflow's version bump step. The previous
git diff --quiet(without--cached) compared the working tree to the index, which is in sync immediately aftergit add -A. So no commit was ever created. The publish step ran anyway becausepnpm changeset versionhad locally modified files, butgit push origin HEADhad nothing to push.Symptom observed during PR #44 release
@deessejs/errorsran throughpnpm changeset version(consuming all 7 changesets to bump 1.1.1 → 1.2.0 locally), but the version bump commit was never created and pushed. The release workflow then attemptedpnpm changeset publish, which failed withENEEDAUTH(trusted publishing was pointed at the wrong environment — now fixed on npmjs.com).What this PR changes
release.yml:git diff --quiet || git commit -m ...→git diff --cached --quiet || git commit -m .... The commit now compares against HEAD instead of the index, which is what we want aftergit add -A.What this PR triggers on merge
The release workflow runs again. Pending changesets in the diff:
fix-release-version-commit.md(this commit's changeset, patch)If the OIDC trusted publisher is now correctly configured on npmjs.com,
@deessejs/errors@1.2.1will be published. (The previous 1.2.0 bump that never made it is now lost — that's fine, the new version supersedes it.)Affected file
.github/workflows/release.yml.changeset/fix-release-version-commit.md🤖 Generated with Claude Code