Fix attach-release-zip workflow: broken composer auth + packaged empty dist/ - #291
Closed
Castellon-ACM wants to merge 10 commits into
Closed
Fix attach-release-zip workflow: broken composer auth + packaged empty dist/#291Castellon-ACM wants to merge 10 commits into
Castellon-ACM wants to merge 10 commits into
Conversation
Builds the production zip with wp-cli's dist-archive-command (the same tool used for manual releases, honouring .distignore) and uploads it as an asset on the GitHub Release once published, so the plugin can be installed straight from the Releases page. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
--filename-format is silently ignored when <target> names a file, so switch to a directory target with --create-target-dir. Also bumps dist-archive-command to ^3.0 (a tagged release), the minimum version that supports --filename-format. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The PR's own test plan flagged this as unverified: nothing exercises the workflow end to end without publishing a real release. A manual tag_name input lets it be re-run against an already-published release (re-checking out that tag) to confirm the zip actually gets attached. Also drops the now-redundant mkdir -p dist: --create-target-dir already creates the target directory.
wp package install (via Composer) auto-detects the GitHub CLI that hosted runners pre-authenticate, and using it fails with "Your github oauth token for github.com contains invalid characters" — confirmed via a debug run that none of GITHUB_TOKEN/GH_TOKEN/COMPOSER_AUTH were set as env vars, so the token came from gh's own stored auth, not the job env. dist-archive-command is a public package, so forcing anonymous Composer API access for this one step is safe.
COMPOSER_AUTH='{}' alone didn't fix it — Composer calls \`gh auth
token\` directly regardless of COMPOSER_AUTH when gh is on PATH. The
runner's pre-authenticated gh CLI returns something Composer's own
validation rejects. Logging gh out for this one step removes that
stored auth so Composer falls back to unauthenticated (fine for a
public package); the final upload step re-authenticates gh explicitly
via GH_TOKEN regardless.
…ist/ wp dist-archive's own --create-target-dir target (./dist) lived inside the plugin directory being archived, and .distignore has no entry for it, so the resulting zip packaged an empty frontblocks/dist/ folder — confirmed by inspecting the zip uploaded to the 1.5.2 release. Building into runner.temp instead keeps the archive output entirely outside the source tree being walked.
The real culprit (confirmed via debug output, since gh CLI was already logged out with no effect): shivammathur/setup-php writes a github-oauth token into ~/.composer/auth.json to avoid GitHub API rate limits during its own setup, and this Composer version rejects that token as malformed. Unsetting the global config entry (not gh auth, which was a dead end) fixes it — verified against a real published release.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #290 merged a workflow that turned out to be broken end-to-end — verified live against the real
1.5.2release via the newworkflow_dispatchtrigger this PR adds:wp package installfailed every time withYour github oauth token for github.com contains invalid characters. Root cause:shivammathur/setup-phpwrites agithub-oauthtoken into Composer's globalauth.json(to dodge GitHub API rate limits during its own setup) that this Composer version's own validation rejects as malformed. Fixed by unsetting that config entry before installingdist-archive-command— this repo's public package install doesn't need authentication anyway.frontblocks/dist/folder.wp dist-archive's own--create-target-diroutput (./dist) lived inside the plugin directory being archived, and.distignorehas no entry for it, so it got swept into the zip. Fixed by building into${{ runner.temp }}/dist, outside the checkout entirely.workflow_dispatchwith atag_nameinput so this workflow can be tested against an already-published release without cutting a new one — this is how both bugs above were actually found and confirmed fixed, rather than discovered on the next real release.Test plan
1.5.2release, iterated until greenfrontblocks-1.5.2.zipasset and confirmed: 231 files, single top-levelfrontblocks/folder, nodist/entry, nocomposer.json/package.json/node_modules/tests//.github