From 6a43a4705b60f944fe5ba97a59e5daa6ecd6cb91 Mon Sep 17 00:00:00 2001 From: shenxianpeng Date: Thu, 9 Jul 2026 01:05:11 +0300 Subject: [PATCH] fix: restrict TestPyPI publish to main branch only The TestPyPI publish step ran on every non-tag push (including PR merges to any branch), potentially producing garbage versions. Added 'github.ref == refs/heads/main' to restrict it to main branch pushes. --- .github/workflows/py-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/py-publish.yml b/.github/workflows/py-publish.yml index 8db22ee..12d1c04 100644 --- a/.github/workflows/py-publish.yml +++ b/.github/workflows/py-publish.yml @@ -38,7 +38,7 @@ jobs: subject-path: 'dist/*' - name: Publish package (to TestPyPI) - if: startsWith(github.repository, 'cpp-linter') && !startsWith(github.ref, 'refs/tags/') + if: startsWith(github.repository, 'cpp-linter') && !startsWith(github.ref, 'refs/tags/') && github.ref == 'refs/heads/main' env: TWINE_USERNAME: __token__ TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }} # zizmor: ignore[secrets-outside-env]