From 9e52847c43d1ac9628479f172f7f04aa40c874dd Mon Sep 17 00:00:00 2001
From: Shrey Pandya <shrey@browserbase.com>
Date: Thu, 16 Jul 2026 10:02:28 -0700
Subject: [PATCH] Fix tag-release: GITHUB_TOKEN tag pushes don't trigger other
 workflows

Confirmed live: merging PR #3 pushed tag v0.3.0 correctly, but
release.yml never ran and no GitHub Release was created. Root cause
is a documented GitHub Actions behavior -- a tag pushed using the
default GITHUB_TOKEN from within a workflow run does not trigger
other workflows' push events, to prevent infinite loops. That
exemption does not apply to workflow_dispatch, so tag-release now
explicitly dispatches release.yml instead of relying on push:tags.

release.yml's workflow_dispatch trigger only exists on main, not on
the tag itself, and softprops/action-gh-release can't infer the
right tag from a workflow_dispatch context (it falls back to
github.ref_name, which would be "main"). So the dispatch passes an
explicit tag input, and both the checkout step and the release step
use it to check out and tag the correct ref.
---
 .github/workflows/release.yml  | 14 ++++++++++++++
 .github/workflows/validate.yml | 11 +++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 798b14a..1696f3c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,17 @@ on:
   push:
     tags:
       - "v*"
+  # tag-release (in validate.yml) pushes the tag using the default
+  # GITHUB_TOKEN, which GitHub does not allow to trigger other workflows
+  # (loop prevention), so it explicitly re-dispatches this workflow instead
+  # of relying on the push trigger above to fire. The tag input tells this
+  # run which tag to check out and release, since a workflow_dispatch run
+  # has no tag ref of its own to infer one from.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release (e.g. v0.3.0)"
+        required: true
 
 permissions:
   contents: write
@@ -14,6 +25,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
 
       - uses: actions/setup-node@v4
         with:
@@ -43,5 +56,6 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: release.tar.gz
           generate_release_notes: true
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 8aa927c..90661b9 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -33,6 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      actions: write
 
     steps:
       - uses: actions/checkout@v4
@@ -40,6 +41,8 @@ jobs:
           fetch-depth: 0
 
       - name: Tag plugin.json's version if untagged
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           VERSION=$(node -pe "JSON.parse(require('fs').readFileSync('plugin.json', 'utf8')).version")
           TAG="v${VERSION}"
@@ -53,3 +56,11 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git tag "$TAG"
           git push origin "$TAG"
+
+          # A tag pushed with the default GITHUB_TOKEN does not trigger
+          # other workflows' push:tags events (GitHub's loop-prevention),
+          # so explicitly dispatch release.yml instead of relying on the
+          # push trigger to fire. release.yml's workflow_dispatch only
+          # exists on main, not on the tag itself, so dispatch against
+          # main and pass the tag as an input for it to check out.
+          gh workflow run release.yml --repo "${{ github.repository }}" -f tag="$TAG"