From 4cd8648a05ad1e1160c9f385169a1bd32ca9bf93 Mon Sep 17 00:00:00 2001
From: Michal Kinas <113341662+MichalKinas@users.noreply.github.com>
Date: Fri, 3 Jul 2026 07:56:50 +0200
Subject: [PATCH] Adjust release triggers to use cache-writable token (#12030)

---
 .github/actions/before-install/action.yml |  9 +++++++--
 .github/actions/enable-dryrun/action.yml  |  4 ++--
 .github/workflows/release.yml             | 24 ++++++-----------------
 3 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/.github/actions/before-install/action.yml b/.github/actions/before-install/action.yml
index 9aa3cd34f3..eeab321e02 100644
--- a/.github/actions/before-install/action.yml
+++ b/.github/actions/before-install/action.yml
@@ -12,9 +12,14 @@ runs:
     - name: base vars
       shell: bash
       run: |
+        if [ -n "${GITHUB_BASE_REF:-}" ]; then
+          BASE_HASH=$(git merge-base "origin/${GITHUB_BASE_REF}" HEAD 2>/dev/null || git rev-parse HEAD)
+        else
+          BASE_HASH=$(git rev-parse HEAD)
+        fi
         {
           echo "GIT_HASH=$(git rev-parse HEAD)";
-          echo "BASE_HASH=$(git merge-base origin/${GITHUB_BASE_REF} HEAD)";
+          echo "BASE_HASH=${BASE_HASH}";
           echo "HEAD_HASH=HEAD";
           echo "HEAD_COMMIT_HASH=${GH_COMMIT}";
           echo "NX_CALCULATION_FLAGS=--all";
@@ -55,7 +60,7 @@ runs:
         } >> $GITHUB_ENV
 
     - name: RELEASE on master/develop patch branch
-      if: ${{ env.BREAK_ACTION == false && github.event.pull_request.merged }}
+      if: ${{ env.BREAK_ACTION == false && (github.event.pull_request.merged || github.event_name == 'push') }}
       shell: bash
       env:
         REF_NAME: ${{ github.ref_name }}
diff --git a/.github/actions/enable-dryrun/action.yml b/.github/actions/enable-dryrun/action.yml
index 62df25cc1b..55222490ec 100644
--- a/.github/actions/enable-dryrun/action.yml
+++ b/.github/actions/enable-dryrun/action.yml
@@ -23,8 +23,8 @@ runs:
       env:
         DRY_RUN_FLAG: ${{ inputs.dry-run-flag }}
       run: |
-          if [[ '$DRY_RUN_FLAG' == 'true' ]]; then
-            echo "dryrun=--dryrun" >> $GITHUB_OUTPUT;
+          if [[ "$DRY_RUN_FLAG" == 'true' ]]; then
+            echo "dryrun=--dry-run" >> $GITHUB_OUTPUT;
             echo "enabling dryrun"
           else
             echo "dryrun=" >> $GITHUB_OUTPUT;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a3c522d627..b88cae45b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,6 @@
 name: "release"
 
 on:
-  workflow_call:
-    inputs:
-      dry-run-flag:
-        description: 'enable dry-run on artifact push'
-        required: false
-        type: boolean
-        default: true
   workflow_dispatch:
     inputs:
       dry-run-flag:
@@ -15,13 +8,10 @@ on:
         required: false
         type: boolean
         default: true
-  pull_request:
-    types: [closed]
+  push:
     branches:
       - develop
       - develop-patch*
-  push:
-    branches:
       - master
       - master-patch-*
 
@@ -34,8 +24,6 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  BASE_REF: ${{ github.base_ref }}
-  HEAD_REF: ${{ github.head_ref }}
   GH_COMMIT: ${{ github.sha }}
   GH_BUILD_NUMBER: ${{ github.run_id }}
   LOG_LEVEL: "ERROR"
@@ -44,7 +32,7 @@ env:
 jobs:
   setup:
     timeout-minutes: 20
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     name: "Setup"
     runs-on: ubuntu-latest
     permissions:
@@ -68,7 +56,7 @@ jobs:
     outputs:
       release_version: ${{ steps.set-version.outputs.release_version }}
     timeout-minutes: 30
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       id-token: write  # Required for OIDC
@@ -108,7 +96,7 @@ jobs:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@alfresco'
-      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }} --provenance=false
+      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }} --provenance=false ${{ steps.set-dryrun.outputs.dryrun }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -117,7 +105,7 @@ jobs:
           node-version-file: '.nvmrc'
           registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
           scope: '@alfresco'
-      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }}
+      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }} ${{ steps.set-dryrun.outputs.dryrun }}
 
   create-git-tag:
     runs-on: ubuntu-latest
@@ -138,7 +126,7 @@ jobs:
   npm-check-bundle:
     needs: [release-npm]
     timeout-minutes: 15
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository