From 5fedc5de9dbfde01c518593761f1b3d5760b00b5 Mon Sep 17 00:00:00 2001 From: Aaron Bacchi Date: Tue, 3 Nov 2026 09:30:09 -0500 Subject: [PATCH] [DEVOPS-12319] Only publish to PyPI and GHCR after a successful build When build is skipped or fails, test-build is skipped too, and the 'success or skipped' check let pypi-publish and container-publish run anyway. Since #2098, build is skipped whenever check-draft-release fails, so a run against an already-published release would still have pushed the container image to ghcr.io (:latest and :). Found in a dry run of the release flow in a fork. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 296463ef2..4506cc483 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -220,8 +220,11 @@ jobs: pypi-publish: runs-on: ubuntu-latest needs: ['build', 'test-build'] + # build must be checked too: when it is skipped or fails, test-build is + # skipped as well, which would otherwise let this job run. if: | always() && + needs.build.result == 'success' && (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag environment: name: publish @@ -265,8 +268,11 @@ jobs: outputs: image: ${{ steps.image.outputs.image }} digest: ${{ steps.build_container.outputs.digest }} + # build must be checked too: when it is skipped or fails, test-build is + # skipped as well, which would otherwise let this job run. if: | always() && + needs.build.result == 'success' && (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag env: CONTAINER_IMAGE: "ghcr.io/${{ github.repository }}"