| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Check generated docs without writing or hiding partial staging | 18 天前 | |
Pin checkout and setup-node to commits in the release job Every action in the job that holds the npm trusted-publishing identity and a write-scoped token is now referenced by commit, so none of the code it runs can change under a moved tag. Both move from v4 to v7. The breaking changes across those majors do not reach this workflow: setup-node's automatic package-manager caching keys off a packageManager field in package.json, which this project does not set, and its removal of the dummy NODE_AUTH_TOKEN export only affects token-based publishing rather than the OIDC path used here. checkout's fork-checkout restriction applies to pull_request_target and workflow_run, neither of which triggers this workflow, and its move to storing credentials outside .git/config narrows what a later step in the job can read. | 3 个月前 |