From c0782a641b9d485535249319961176c59502bbb4 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Thu, 30 Apr 2026 11:04:00 +0200 Subject: [PATCH] chore(release): drop deprecated `with:` block and workflow_dispatch.bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both inputs that this caller used to pass to the upstream reusable release workflow are now deprecated/ignored: - `bump` was deprecated when the auto-bump job was removed from skill-repo-skill (releases now happen via signed tag-push only). - `attest` (matrix-skill only) was deprecated when SLSA build provenance flipped from opt-in to always-on in netresearch/skill-repo-skill#79. Removing them keeps release.yml honest. Also drops the workflow_dispatch trigger entirely — clicking "Run workflow" did nothing useful since the upstream only acts on tag-push. Comments on the id-token/attestations grants are normalized away from "required when attest: true" to "required by the attest job". Net effect: zero behaviour change. Releases continue to ship via signed tag-push and produce SLSA-attested archives. --- .github/workflows/release.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9eb6647..7d7c4cf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,22 +4,10 @@ on: push: tags: - 'v*' - workflow_dispatch: - inputs: - bump: - description: 'Version bump type' - required: true - type: choice - options: - - patch - - minor - - major jobs: release: uses: netresearch/skill-repo-skill/.github/workflows/release.yml@main - with: - bump: ${{ inputs.bump }} permissions: contents: write # release upload id-token: write # OIDC for sigstore (required by the attest job)