mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Joey Perrott
1b7dcc854a
The Googler check moved out of `pack-and-upload-artifact` and into the pull request labeling action, which runs in a privileged `pull_request_target` context where secrets are available. The build job runs on `pull_request` and never receives secrets, so it no longer needs `angular-robot-key` or `triggering-label`, and the `bypassed_for_forks` placeholder can go away. Bumps the dev-infra pins to pick up that change.
25 lines
702 B
YAML
25 lines
702 B
YAML
name: Publish Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- '[0-9]+.[0-9]+.x'
|
|
workflow_dispatch: # Allow manual trigger for verification
|
|
|
|
# Ensure only one release runs at a time PER BRANCH to avoid race conditions.
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read # Required to checkout the repository
|
|
id-token: write # Required for NPM provenance in reusable workflow
|
|
|
|
jobs:
|
|
release:
|
|
uses: angular/dev-infra/.github/workflows/reusable-release.yml@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
|
|
secrets:
|
|
wombot-token: ${{ secrets.WOMBOT_TOKEN }}
|
|
angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
|