From c291b7b435ffbd11b447251c440536aeb06d3aaf Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 28 Jun 2026 18:32:14 -0700 Subject: [PATCH] Clarify publisher comment: only Actions Dependabot bumps skip republish The header said "Dependabot churn does not republish", which now reads wrong since a package-version bump does republish. Narrow it: an Actions Dependabot bump does not republish; a package-version bump does. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index abf85f2..bd3bf24 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -8,7 +8,7 @@ name: Publish project release action # (Directory.Packages.props) ARE listed: a NuGet package cannot be rebuilt on a cadence (a version can't be # re-pushed), so a dependency bump must republish to keep the package's declared dependencies current - this # closes the stale/vulnerable-dependency window. GitHub Actions bumps are not listed (they do not ship in -# the package), so that Dependabot churn does not republish. +# the package), so an Actions Dependabot bump does not republish (a package-version bump does). # - Output: main publishes a stable release, develop a prerelease. A dispatch force-publishes its branch. # - Gate: the publish job needs the same validate-task the PR runs, so nothing publishes that would fail # validation, on any path (push, dispatch, or force-push).