[3m1n3nc3]

The Publish to NPM workflow ignored the release tag. Publishing release 1.5.0 put 1.3.37 on npm, because the workflow only bumped the patch of the published version.

Changes

A single "Resolve version" step now chooses the version in this order:

1. The version input on a manual run.
2. The release tag on a release (or a tag push). A leading v is dropped, so both 1.5.0 and v1.5.0 work.
3. Otherwise, package.json if it's ahead of npm, or a patch bump from the npm version.

The step fails early if the version isn't valid semver or is already on npm, so a stale or reused tag fails before tests and build run, not at pnpm publish.

The new version is written to package.json for the build. After the publish, it's committed to main from a fresh checkout of main. The old step pushed HEAD:main from the release's detached tag checkout, which fails when main has moved past the tag.

This also removes the broken "Set version from input" step, which wrote to $GITHUB_OUTPUT without a step id.

Testing

I ran the version step locally with a stubbed pnpm view for these cases: a release tag, a v tag, no tag (patch bump), an input version that's already published (fails), and an invalid tag (fails).

Releases still publish only resora. Publishing @resora/plugin-clear-router still uses a manual run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!