From f19b382c4c7c98ad7ab1564875223aed4f5cb409 Mon Sep 17 00:00:00 2001
From: Will Ezell <will@dotcms.com>
Date: Wed, 16 Sep 2026 18:03:43 -0400
Subject: [PATCH] fix(cli-release): make dry-run actually dry and always clean
 up

Two issues found while validating the CLI release after #37568:

- JRELEASER_DRY_RUN was never read by the jreleaser-maven-plugin (it uses the
  property jreleaser.dry.run), and publish-npm-package ignored the input, so a
  workflow_dispatch with dry-run=true created a real GitHub release and ran
  npm publish. Set the plugin property and skip the NPM job on dry-run.
- clean-up 'needs' publish-npm-package without 'always()', so skipping the NPM
  job on a dry-run leaked the version-update auxiliary branch.

Refs #37567
---
 .github/workflows/cicd_release-cli.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cicd_release-cli.yml b/.github/workflows/cicd_release-cli.yml
index b3eb41a8c4a..649b9ccbd0a 100644
--- a/.github/workflows/cicd_release-cli.yml
+++ b/.github/workflows/cicd_release-cli.yml
@@ -177,12 +177,14 @@ jobs:
         env:
           JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           JRELEASER_PROJECT_VERSION: ${{ needs.precheck.outputs.RELEASE_VERSION }}
-          JRELEASER_DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
         with:
           cleanup-runner: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
           stage-name: "JReleaser"
-          maven-args: "-Prelease validate -DartifactsDir=artifacts -Dm2Dir=$HOME/.m2/repository -Djreleaser.git.root.search=true -pl :dotcms-cli-parent -Dmaven.plugin.validation=VERBOSE"
+          # The plugin's dry-run is the Maven property jreleaser.dry.run (it does not
+          # read JRELEASER_DRY_RUN), so set it explicitly; otherwise a dry-run
+          # dispatch would create a real GitHub release.
+          maven-args: "-Prelease validate -DartifactsDir=artifacts -Dm2Dir=$HOME/.m2/repository -Djreleaser.git.root.search=true -pl :dotcms-cli-parent -Dmaven.plugin.validation=VERBOSE ${{ github.event.inputs.dry-run == 'true' && '-Djreleaser.dry.run=true' || '' }}"
           artifacts-from: ${{ env.ARTIFACT_RUN_ID }}
           version: ${{ needs.precheck.outputs.RELEASE_VERSION }}
 
@@ -229,7 +231,8 @@ jobs:
   # Publish NPM package
   publish-npm-package:
     name: "Publish NPM Package"
-    if: success()  # Run only if explicitly indicated and successful
+    # Never publish on a dry-run dispatch (this job runs `npm publish` for real).
+    if: success() && github.event.inputs.dry-run != 'true'
     needs: [ precheck, build, build-cli, release ]
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps:
@@ -395,7 +398,9 @@ jobs:
   # Clean up temporary branches
   clean-up:
     name: "Clean Up"
-    if: ${{ needs.precheck.outputs.AUXILIARY_BRANCH != '' }}
+    # always(): the auxiliary branch must be deleted even when an earlier job is
+    # skipped (e.g. publish-npm-package on a dry-run) or has failed.
+    if: ${{ always() && needs.precheck.outputs.AUXILIARY_BRANCH != '' }}
     needs: [ precheck, build, build-cli, release, publish-npm-package ]
     runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }}
     steps: