ci: keep beta on the promoted version, and give the announce job a checkout

[twk3]

2.7.0 is on latest. The promotion worked once a trusted publisher configuration naming promote.yaml existed — those are keyed on the workflow filename, so the entry covering publish.yaml authorized nothing here. That was the whole of the E401.

Three changes, each from something that run showed.

Promotion leaves beta alone

beta stays on the version just promoted. Every publish to that channel sets the tag, so it cannot go stale; between releases beta and latest simply name the same version.

It also makes the step idempotent by construction. dist-tag add sets a tag to the version it already holds without complaint, so a promotion that failed partway can be dispatched again — which the 2.7.0 run could not, because dist-tag rm beta errors once beta is gone. The conditional that existed to work around that is gone with the removal it guarded.

One wart worth naming: publishing a version straight to latest (which publish.yaml allows) would leave beta behind latest until the next beta publish. Visible, not harmful — @beta would just resolve to an older version than @latest, which is an accurate description of what exists.

The announce job needs a checkout

linear-release exits before doing anything when there is no .git directory, whichever command it is given — complete needs a working tree even though it scans no commits:

Error: linear-release must run inside a git repository, but no `.git` directory was found.

That is my error from #237: I wrote that complete needs no checkout, when what I had established was only that the action's README omits one from its complete example. The job now checks out at the fetch-depth its quick start documents.

The 2.7.0 release is consequently still open in Linear with nothing posted to Slack, and needs closing by hand.

Withdrawn: the setup-node change this PR originally made

I had removed registry-url on the theory that the _authToken line setup-node writes preempts the OIDC exchange (actions/setup-node#1551). The successful run disproves it: it ran with registry-url set and exchanged an OIDC credential anyway. publish.yaml had been publishing that way all along, which I noted as an unexplained contradiction at the time instead of treating it as the answer. The npmrc guard went with it — with registry-url restored it would fail every run on the token setup-node writes.

What survives from that work is the error message, now naming the real cause, and RELEASE.md, which described one trusted publisher configuration per package when there is one per workflow file.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y4EZAEvxLfXuMeNz5ZgCMz

[baz-reviewer]

Baz Summary

Update the promotion workflow to retain the beta tag on the promoted version and improve its trusted-publishing guidance. Add the required checkout for linear-release so Linear completion and Slack announcement can run from a Git repository.

Topics

Topic	Details
Announce release	Check out the repository before invoking linear-release, enabling the release completion and announcement flow to operate successfully. Modified files (1) .github/workflows/promote.yaml Latest Contributors(2) User Commit Date noreply@anthropic.com ci: keep the checkout ... October 14, 2026 agoldis@gmail.com chore: update Node.js ... January 27, 2026
Promote release tags	Keep beta assigned to the promoted version, make promotion reruns idempotent, and clarify workflow-specific npm trusted publisher permissions and required credentials handling. Modified files (2) .github/workflows/promote.yaml RELEASE.md Latest Contributors(2) User Commit Date noreply@anthropic.com ci: keep the checkout ... October 14, 2026 gimenez.maxi@gmail.com chore: add slack notif... May 28, 2026

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}