forzagreen / n2words / 26670417853

98%

push

github

ci(core): correct release tag/push ordering and harden workflow scripts (#305)

* ci(core): don't rebase before pushing the release tag

The release job publishes to npm BEFORE it tags and pushes. The
package is built from the chore(release) commit's working tree, so
that commit's tree is the artifact of record.

The pre-push `git pull --rebase --autostash origin main` (added in
#303) breaks that guarantee under a race: if any PR merges to main
while the release runs, the rebase replays the chore(release) commit
on top of the new main. The tag then points at a tree containing
source the published npm package was never built from (tag/artifact
mismatch), and the merged PR sinks below the tag where the next
`git-cliff --bumped-version` walk skips it — silently dropping it
from the changelog.

Drop the rebase and let the race fail loud: a concurrent merge makes
the push a non-fast-forward and `--atomic` rejects both main and the
tag. That state is recoverable (the package is already on npm; re-run
the release or push the commit + tag by hand once main is stable),
and strictly safer than a silent mismatch.

* ci(core): use printf instead of echo to pipe the PR title

`echo "$PR_TITLE"` interprets a title that is exactly a flag token
(-n, -e, -E, -ne, ...) as an echo option rather than text, and the
behavior is further shell-dependent (POSIX echo is underspecified;
xpg_echo changes it). commitlint would then validate a truncated or
altered title. `printf '%s\n'` emits the title verbatim regardless of
its leading characters or the shell.

* ci(core): bump actionlint pin to v1.7.12

Move the actionlint installer URL and binary pin from v1.7.6 to
v1.7.12. Both stay pinned to the same tag so the fetched script and
the binary it installs always agree.

5140 of 5605 branches covered (91.7%)

Branch coverage included in aggregate %.

28523 of 29458 relevant lines covered (96.83%)

28.1 hits per line