Skip to content

fix(ci): publish workflow CodeQL cache-poisoning - #79

Merged
franciscbalint merged 1 commit into
masterfrom
fix/publish-codeql-checkout-2026-10-14
Oct 17, 2026
Merged

franciscbalint merged 1 commit into
masterfrom
fix/publish-codeql-checkout-2026-10-14

Conversation

@franciscbalint

Copy link
Copy Markdown
Collaborator

Summary

  • Test/build/publish jobs checkout refs/tags/${{ github.event.inputs.tag }} after validate-tag (not tag_sha job output).
  • Release jobs keep tag_sha with environment: release.

Reopened as a new PR because the previous one was closed without merge and its branch was deleted.

Test plan

  • CodeQL passes on this PR
  • Publish workflow still validates tags as before

Made with Cursor

Use refs/tags input for test/build jobs; keep tag_sha on release and
registry publish jobs with environment: release (Pascal PR #18 lesson).

Co-authored-by: Cursor <cursoragent@cursor.com>
@franciscbalint
franciscbalint merged commit f5a2a78 into master Oct 17, 2026
13 checks passed
@franciscbalint
franciscbalint deleted the fix/publish-codeql-checkout-2026-10-14 branch October 17, 2026 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant