From 16df9ccd59416e874efd1565dc16fe41f772a496 Mon Sep 17 00:00:00 2001 From: Gabriel Taveira Date: Sun, 26 Jul 2026 22:03:42 -0300 Subject: [PATCH] ci: say what to do when the release PR can't be opened v1.0.10 published to npm and tagged, then the workflow died on `gh pr create` with "GitHub Actions is not permitted to create or approve pull requests", which left master a version behind the registry. That repo setting is off by default and is now on. GITHUB_TOKEN has no permission scope that can read that setting, so the workflow can't check it before publishing. The step now prints the branch to open a PR from and the setting to turn on, instead of leaving a bare GraphQL error in the log. --- .github/workflows/release.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4d9425e..08bd092 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -98,8 +98,17 @@ jobs: Auto-merges as a merge commit once CI and CodeQL pass. A squash would rewrite the commit and leave the tag outside master's history, which breaks the changelog range for the next release. BODY - url=$(gh pr create --base "$BASE" --head "$branch" \ - --title "chore(release): v$VERSION" --body-file /tmp/pr-body.md) + # npm and the tag are already out by this point, so a failure here + # leaves master a version behind the registry. The usual cause is + # "Allow GitHub Actions to create and approve pull requests" being + # off, and the GITHUB_TOKEN has no scope to read that setting, so say + # what to do rather than let a bare GraphQL error stand. + if ! url=$(gh pr create --base "$BASE" --head "$branch" \ + --title "chore(release): v$VERSION" --body-file /tmp/pr-body.md 2>&1); then + echo "$url" + echo "::error::v$VERSION is on npm and tagged, but the bump PR could not be opened, so master is behind. The branch $branch is pushed: open a PR from it and merge with a merge commit, not a squash. If the error mentions Actions not being permitted to create pull requests, turn that on under Settings > Actions > General." + exit 1 + fi number="${url##*/}" echo "opened $url"