From 644915360efc626b5cd93d09f7f304bf17390a17 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 21:53:38 -0400 Subject: [PATCH 1/7] ci: bump ci.yml's action pin during release prep The release-prepare workflow updated README action-usage pins but not ci.yml's own two `.../report@vX.Y.Z` references, so this repo's CI kept pinning the report action to a stale version after every release (as just happened: category support shipped in the action, but ci.yml still referenced @v0.3.0, which predates it). Requires workflows: write since the release commit now touches a file under .github/workflows/. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release-prepare.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index 162662b..e527a7e 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -17,6 +17,10 @@ on: permissions: contents: write pull-requests: write + # Needed because the release commit touches .github/workflows/ci.yml + # (bumping its action-usage pin) — the GitHub API rejects workflow-file + # writes from a token without this permission, even with contents: write. + workflows: write concurrency: group: release @@ -78,10 +82,10 @@ jobs: (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version) done - - name: Update README action-usage pins + - name: Update action-usage pins run: | sed -i -E "s#(\.github/actions/report@v)[0-9]+\.[0-9]+\.[0-9]+#\1${VERSION}#g" \ - README.md .github/actions/report/README.md + README.md .github/actions/report/README.md .github/workflows/ci.yml - name: Create release branch env: @@ -100,7 +104,7 @@ jobs: package.json package-lock.json \ dashboard/package.json dashboard/package-lock.json \ .github/actions/report/package.json .github/actions/report/package-lock.json \ - CHANGELOG.md README.md .github/actions/report/README.md + CHANGELOG.md README.md .github/actions/report/README.md .github/workflows/ci.yml - name: Open release PR env: From 910fdeb3fd6788057e969bc943d0f6a15ba5dada Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:01:10 -0400 Subject: [PATCH 2/7] ci: bump ci.yml's action pin to v0.4.0, allow bot PR reviews - Manually bump ci.yml's two report-action pins from @v0.3.0 to @v0.4.0 ahead of the v0.4.0 tag, since release/v0.4.0 was already branched before the release-prepare.yml fix in this PR existed to do it automatically. - Add allowed_bots to claude-code-review.yml so Dependabot and Copilot PRs get reviewed instead of skipped. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/claude-code-review.yml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d9c61ef..59e8466 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,7 +79,7 @@ jobs: retention-days: 30 - name: Report coverage - uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.3.0 + uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev coverage-path: dashboard/coverage/lcov.info @@ -115,7 +115,7 @@ jobs: run: npm run test:coverage - name: Report coverage - uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.3.0 + uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev category: backend diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index b5e8cfd..0a0417d 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -39,6 +39,7 @@ jobs: plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + allowed_bots: "dependabot[bot],copilot[bot]" # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md # or https://code.claude.com/docs/en/cli-reference for available options From e33f1522ece40d3d28a9e5118123aa1747bab508 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:04:42 -0400 Subject: [PATCH 3/7] ci: skip coverage reporting on release-branch PRs release-prepare.yml (and the manual bump in this PR) pins ci.yml's report-action reference to the version being released before its tag exists, so any PR against a release/vX.Y.Z branch fails at action resolution. Skip the Report coverage step in that case; it still runs normally on PRs against main and on push (post-merge, once the tag is live). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59e8466..e6fa0d9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,6 +79,10 @@ jobs: retention-days: 30 - name: Report coverage + # Release-prep PRs (base release/vX.Y.Z) bump this pin ahead of the + # tag actually existing — resolving the action would fail. The tag is + # live by the time the release PR merges to main and this re-runs. + if: ${{ !(github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/v')) }} uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev @@ -115,6 +119,10 @@ jobs: run: npm run test:coverage - name: Report coverage + # Release-prep PRs (base release/vX.Y.Z) bump this pin ahead of the + # tag actually existing — resolving the action would fail. The tag is + # live by the time the release PR merges to main and this re-runs. + if: ${{ !(github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/v')) }} uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev From cabcb1d3a3adb0fc6e3b1c2f8f2fa4330f042503 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:08:07 -0400 Subject: [PATCH 4/7] Revert "ci: skip coverage reporting on release-branch PRs" This reverts commit e33f1522ece40d3d28a9e5118123aa1747bab508. --- .github/workflows/ci.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e6fa0d9..59e8466 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,10 +79,6 @@ jobs: retention-days: 30 - name: Report coverage - # Release-prep PRs (base release/vX.Y.Z) bump this pin ahead of the - # tag actually existing — resolving the action would fail. The tag is - # live by the time the release PR merges to main and this re-runs. - if: ${{ !(github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/v')) }} uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev @@ -119,10 +115,6 @@ jobs: run: npm run test:coverage - name: Report coverage - # Release-prep PRs (base release/vX.Y.Z) bump this pin ahead of the - # tag actually existing — resolving the action would fail. The tag is - # live by the time the release PR merges to main and this re-runs. - if: ${{ !(github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/v')) }} uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 with: worker-url: https://demo.coveragetracker.dev From 35693804b07ce656f170cfa7c6960f4c76d3c206 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:08:24 -0400 Subject: [PATCH 5/7] ci: skip the whole workflow for PRs targeting a release branch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Step-level `if:` doesn't work here — GitHub Actions resolves every `uses:` reference in a job during job setup regardless of each step's condition, so the just-bumped-but-not-yet-tagged report-action pin still fails resolution even when the step using it is skipped. Excluding release/** as a pull_request base branch prevents the workflow from starting at all, which is the only way to avoid it. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59e8466..b73c9c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,6 +13,12 @@ on: - 'package-lock.json' - '.github/workflows/ci.yml' pull_request: + # release-prepare.yml bumps this file's report-action pin ahead of the + # tag actually existing, so PRs targeting a release/vX.Y.Z branch can't + # resolve it. Skip the workflow entirely for those; the tag is live by + # the time the release PR (base main) merges. + branches-ignore: + - 'release/**' paths: - 'dashboard/**' - 'src/**' From 679e225a4a0852009c2a62be4d51cac850b593f1 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:33:12 -0400 Subject: [PATCH 6/7] Revert "ci: skip the whole workflow for PRs targeting a release branch" This reverts commit 35693804b07ce656f170cfa7c6960f4c76d3c206. --- .github/workflows/ci.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b73c9c6..59e8466 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,12 +13,6 @@ on: - 'package-lock.json' - '.github/workflows/ci.yml' pull_request: - # release-prepare.yml bumps this file's report-action pin ahead of the - # tag actually existing, so PRs targeting a release/vX.Y.Z branch can't - # resolve it. Skip the workflow entirely for those; the tag is live by - # the time the release PR (base main) merges. - branches-ignore: - - 'release/**' paths: - 'dashboard/**' - 'src/**' From c52caf3606ceccfdd498ea28a3a27ae33ca64643 Mon Sep 17 00:00:00 2001 From: Torgny Bjers Date: Mon, 6 Jul 2026 22:34:22 -0400 Subject: [PATCH 7/7] ci: reference the report action by local path, not a version pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Point both Report coverage steps at ./.github/actions/report instead of a pinned CoverageTracker/coverage-tracker/.../report@vX.Y.Z tag. This repo dogfoods its own action, so it should run the exact code on the current branch rather than a released version — and a local path never needs resolving a tag/branch at all, which permanently removes the catch-22 where release-prep bumped this pin ahead of the tag existing. Reverts the now-unnecessary release-prepare.yml changes (ci.yml pin bumping, workflows: write) since there's no longer a pin here to bump. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 8 ++++++-- .github/workflows/release-prepare.yml | 10 +++------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 59e8466..0f7320f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -79,7 +79,11 @@ jobs: retention-days: 30 - name: Report coverage - uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 + # Local path, not a pinned release tag: this repo dogfoods its own + # action, so it should always run the exact code on this branch/ref + # rather than a released version that may lag behind (or, during + # release prep, not exist yet as a tag at all). + uses: ./.github/actions/report with: worker-url: https://demo.coveragetracker.dev coverage-path: dashboard/coverage/lcov.info @@ -115,7 +119,7 @@ jobs: run: npm run test:coverage - name: Report coverage - uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0 + uses: ./.github/actions/report with: worker-url: https://demo.coveragetracker.dev category: backend diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index e527a7e..162662b 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -17,10 +17,6 @@ on: permissions: contents: write pull-requests: write - # Needed because the release commit touches .github/workflows/ci.yml - # (bumping its action-usage pin) — the GitHub API rejects workflow-file - # writes from a token without this permission, even with contents: write. - workflows: write concurrency: group: release @@ -82,10 +78,10 @@ jobs: (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version) done - - name: Update action-usage pins + - name: Update README action-usage pins run: | sed -i -E "s#(\.github/actions/report@v)[0-9]+\.[0-9]+\.[0-9]+#\1${VERSION}#g" \ - README.md .github/actions/report/README.md .github/workflows/ci.yml + README.md .github/actions/report/README.md - name: Create release branch env: @@ -104,7 +100,7 @@ jobs: package.json package-lock.json \ dashboard/package.json dashboard/package-lock.json \ .github/actions/report/package.json .github/actions/report/package-lock.json \ - CHANGELOG.md README.md .github/actions/report/README.md .github/workflows/ci.yml + CHANGELOG.md README.md .github/actions/report/README.md - name: Open release PR env: