Repository navigation
ci: split publishing out of the reusable CI workflow - #43
Merged
Merged
Conversation
Foorack
force-pushed
the
ci/split-publish-workflow
branch
from
November 7, 2026 19:25
dc5c5e1 to
de75d28
Compare
ci.yaml is called as a reusable workflow by vrchatapi/specification, and a nested job may not request more permissions than the calling job grants. The publish job needs contents: write and id-token: write for NuGet Trusted Publishing, which forced every caller to hand both over. It now only generates and builds, read-only, and exposes the generated version as a workflow_call output. release.yaml calls it for the build and keeps the elevated permissions on its own publish job.
Foorack
force-pushed
the
ci/split-publish-workflow
branch
from
November 7, 2026 19:29
de75d28 to
db69c5b
Compare
VERSION_POSTPEND was called version_postfix everywhere else.
The publish job can only exist in this repository now, so the explicit repository input does nothing. Concurrency stops two dispatches racing to commit the generated SDK to main.
ariesclark
approved these changes
Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec CI broke after switching to Trusted Publishing for C#:
Spec calls
ci.yamland the publish job needs write + id-token. A called workflow can't ask for more than the caller allows.Fix:
ci.yaml- build only, read-only, still called from specrelease.yaml- new, does the commit back to main and the NuGet pushReading tip: the first commit is a plain rename of
ci.yamltorelease.yamlso the file keeps its history. The newci.yamlcomes after that.