fix(ci): explicitly trigger Maven release workflow from release-please#161
Open
KaviarasuSakthivadivel wants to merge 2 commits into
Open
fix(ci): explicitly trigger Maven release workflow from release-please#161KaviarasuSakthivadivel wants to merge 2 commits into
KaviarasuSakthivadivel wants to merge 2 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #161 +/- ##
=========================================
Coverage 83.10% 83.10%
Complexity 1667 1667
=========================================
Files 119 119
Lines 4641 4641
Branches 493 493
=========================================
Hits 3857 3857
Misses 560 560
Partials 224 224
🚀 New features to boost your workflow:
|
0bda008 to
2f91cbb
Compare
mkaufmann
approved these changes
Mar 9, 2026
5094007 to
148ef5e
Compare
148ef5e to
5ae281c
Compare
j10t
requested changes
Apr 29, 2026
j10t
left a comment
There was a problem hiding this comment.
Thanks for taking this. The wiring is correct end-to-end (verified release.yml has matching workflow_dispatch/tag_name input, release-please-action@v4 emits both outputs as named, no recursion risk).
One change before merge: the script: block interpolates ${{ needs.release-please.outputs.tag_name }} directly into inline JS, which is the pattern GitHub flags as script-injection-prone.
KaviarasuSakthivadivel
added a commit
that referenced
this pull request
Apr 30, 2026
Move tag_name interpolation out of inline JS into an env var and read it via process.env, matching the pattern already used in release.yml. Also scope actions: write to the trigger-maven-release job instead of the whole workflow so release-please runs with minimum privilege. Addresses review feedback from @j10t on PR #161.
GITHUB_TOKEN-triggered events don't cascade to prevent recursive workflows. When release-please creates a release using GITHUB_TOKEN, the 'release: published' event is suppressed and won't trigger the Maven Central publish workflow. Solution: explicitly trigger release.yml via workflow_dispatch when a release is created. Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
Move tag_name interpolation out of inline JS into an env var and read it via process.env, matching the pattern already used in release.yml. Also scope actions: write to the trigger-maven-release job instead of the whole workflow so release-please runs with minimum privilege. Addresses review feedback from @j10t on PR #161.
209051e to
892efa4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GITHUB_TOKEN-triggered events don't cascade to prevent recursive workflows. When release-please creates a release using GITHUB_TOKEN, the 'release: published' event is suppressed and won't trigger the Maven Central publish workflow.
Solution: explicitly trigger release.yml via workflow_dispatch when a release is created.
Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow