1.5 KiB
name, description, metadata
| name | description | metadata | ||
|---|---|---|---|---|
| risk-release-workflow-untestable-pre-tag | .gitea/workflows/release.yml only runs on a v*.*.* tag that also publishes live to the Chrome Web Store — review it by extracting and executing the embedded script locally. |
|
.gitea/workflows/release.yml and .gitea/workflows/deploy-chrome.yml both trigger only on push: tags: v*.*.*, and the deploy workflow publishes live to the Chrome Web Store. A bug in either is first observed during a real release.
Why: there is no dry-run path; CI never exercises these files on a normal push.
How to apply: when a release workflow embeds a script in a heredoc inside a YAML block scalar, extract it and run it rather than reading it. Working recipe used on 2026-08-12:
sed -n '<first>,<last>p' .gitea/workflows/release.yml | sed 's/^ //' > <scratchpad>/brp.js then run it with the relevant env var set, over the real CHANGELOG.md, for: the current tag, an older tag, the oldest tag (last-section / no-next-heading case), a tag with no section (fallback), and a prefix-collision tag such as v1.1.0-beta. This confirmed indentation stripping, heredoc termination, VERSION="$VERSION" node ... env passing, and JSON safety of →/em-dash/backticks in one pass.
Also compare any zip/packaging edit against the known-good pattern at .gitea/workflows/deploy-chrome.yml:47-57 — that pattern was itself a fix (commit 1fedaf4) for a nested-directory zip that Chrome rejected. Related: risk-release-notes-unverified-claims.