From 112be907af1eee0ad4782c80e60e986838377f50 Mon Sep 17 00:00:00 2001 From: Juergen Klaassen Date: Tue, 26 May 2026 08:46:13 -0600 Subject: [PATCH] ci: drop v prefix on release tags (org ruleset blocks v*) PR #37's release attempt got all the way to `gh release create` but failed with: Cannot create ref due to creations being restricted. Published releases must have a valid tag. Root cause: the TheJumpCloud org has a ruleset "Version Tag Protections" (target=tag) that forbids creating refs matching refs/tags/v* (and refs/tags/proto/v*). GITHUB_TOKEN cannot bypass it. The workflow was minting tags like v1.17.0 while the existing release tags (1.15.0, 1.16.0) use the no-prefix convention. Strip the v so the next release lands as 1.17.0 instead of v1.17.0. Matches the org rule and stays consistent with the historical tag scheme. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 46b4b4f..ea8a832 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -112,8 +112,14 @@ jobs: return; } - const tag = `v${next}`; - core.info(`Latest semver tag: v${latest}`); + // No `v` prefix on the tag: the TheJumpCloud org has a + // ruleset "Version Tag Protections" that forbids creating + // refs matching refs/tags/v* (and refs/tags/proto/v*), + // which the GITHUB_TOKEN can't bypass. Existing release + // tags (1.15.0, 1.16.0) already use the no-prefix + // convention, so we match it. + const tag = String(next); + core.info(`Latest semver tag: ${latest}`); core.info(`Next version: ${tag}`); core.setOutput('VERSION', tag);