mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
92c51104d4
Prevents the v3.8.3 incident from recurring, where re-publishing old
releases (v2.5.8/v2.6.4/v3.2.8/v3.3.3) clobbered both Docker Hub
:latest and the npm latest dist-tag with the 3.2.8 build.
docker-publish.yml:
- release.types: published -> released (does not fire on edits)
- new step computes promote_latest only when VERSION equals the highest
semver tag in the repo; pre-release identifiers (-rc/alpha/beta/pre/
next) never claim :latest
- push to main now tags :main only (never :latest)
- skip-if-exists via docker manifest inspect avoids accidental rebuilds
- workflow_dispatch input promote_latest is opt-in for back-fill builds
- all github/inputs context moved into env: to remove script-injection
risk flagged by semgrep
npm-publish.yml:
- release.types: published -> released
- dist-tag resolved by semver compare: only the highest stable tag
becomes latest; older releases fall back to a historic dist-tag
- skip-if-already-published actually works now: dropped the --silent
flag from npm view that suppressed stdout and broke the grep, which
is why 3.2.8 re-published and stole @latest
- npm publish always runs with explicit --tag (no implicit @latest
promotion)
- secrets/inputs moved into env: for the same injection hardening
(cherry picked from commit dedeac4517)