[nieyuanhong]

Summary

The offline bundle codex-proxy-npm.zip has never been attached to a release: the upload step's condition required github.event_name == 'push', but stable releases reach this workflow as a workflow_dispatch --ref <tag> (bot-pushed tags don't fire downstream workflows), so the step was silently skipped every time. Fix: key the condition off the ref alone.

Impact

Since #872 made this bundle the recommended no-auth install path, the documented command currently fails for every reader:

https://github.com/icebear0828/codex-proxy/releases/latest/download/codex-proxy-npm.zip  ->  404

Evidence on the released tags:

tag	npm-publish run	Attach offline npm bundle	asset
v2.1.16	38362508934	skipped	absent
v2.1.17	38592736055	skipped	absent

Both runs are workflow_dispatch on the tag ref, so event_name == 'push' was never true.

Fix

- if: github.event_name == 'push' && github.ref_type == 'tag'
+ if: startsWith(github.ref, 'refs/tags/')

This covers both ways the workflow reaches a tag (real tag push, and the stable-release dispatch), and GITHUB_REF_NAME still resolves to the tag name for gh release upload.

Verification

Reproduced through the exact path that was failing — a fork tag dispatched as workflow_dispatch --ref <tag>:

1. tagged the fix commit, dispatched npm-publish with --ref v2.1.16-npmfix;
2. Attach offline npm bundle to the release → success (previously skipped);
3. asset codex-proxy-npm.zip (12.27 MB) attached to that release and downloaded anonymously (HTTP 200, 12,868,796 bytes).

The temporary test tag/release were deleted afterwards.

Local: npx vitest run tests/unit/npm/npm-package.test.ts tests/unit/ci/package-boundary.test.ts → 22 passed; all workflow YAML parses.

Note on existing releases

A skipped step cannot be recovered by "re-run failed jobs", and re-dispatching npm-publish.yml --ref v2.1.16 does not help either: workflow_dispatch loads the workflow file as committed at that tag, which still contains the old condition, so the step stays skipped.

To backfill v2.1.16 / v2.1.17 (v2.1.16's npm-tarballs artifact is retained until 2026-10-20):

1. download the npm-tarballs artifact from the old run;
2. rebuild the bundle the same way as the step: copy the *.tgz files plus scripts/npm/offline-install.mjs (as install.mjs) into a directory and zip -r codex-proxy-npm.zip .;
3. gh release upload v2.1.16 codex-proxy-npm.zip (and v2.1.17).

Alternatively, run a temporary branch workflow that takes the tag as an inputs.tag and uploads the bundle for that tag.

Changes

• .github/workflows/npm-publish.yml — step condition + comment.
• CHANGELOG.md — [Unreleased] / ### Fixed entry.

[nieyuanhong]

Fork verification before opening this (per my own workflow), all on the exact commit b57a678:

1. The failing path itself — workflow_dispatch --ref <tag>

Tagged the fix commit and dispatched npm-publish with --ref v2.1.16-npmfix on my fork:

• Attach offline npm bundle to the release → success (it was skipped on v2.1.16 / v2.1.17);
• asset codex-proxy-npm.zip (12.27 MB) attached to that release, then downloaded anonymously: HTTP 200, 12,868,796 bytes.

Test tag/release deleted afterwards.

2. Full CI on the fix — fork PR nieyuanhong/codex-proxy#16

• CI - Quality gate: frontend-tests, windows-tests, backend-tests, package-boundary — all success.
• Publish npm packages (pull_request): 8 addon builds + package smoke — all success; publish/verify correctly skipped for PR events.

3. Local

npx vitest run tests/unit/npm/npm-package.test.ts tests/unit/ci/package-boundary.test.ts → 22 passed; every workflow YAML parses.

[SsuJojo]

Review: LGTM (approve) — one note about the backfill claim

Root cause and fix both check out:

• Root cause verified: runs 38362508934 (v2.1.16) and 38592736055 (v2.1.17) are workflow_dispatch with head_branch=v2.1.16/17, and the Attach offline npm bundle to the release step is skipped in both. v2.1.16/v2.1.17 releases indeed have no codex-proxy-npm.zip.
• Dispatch path confirmed: bump-electron.yml tags and then runs gh workflow run npm-publish.yml --ref "$NEW_TAG" → github.ref = refs/tags/<tag>, so startsWith(github.ref, 'refs/tags/') is true. Real tag pushes are still covered, PR (refs/pull/...) and branch dispatches correctly skip.
• Idempotency: gh release upload --clobber + 8×15s retry loop handles both re-runs and the race with release.yml's notes job creating the release first. No asset-name collision with the release workflow.
• Permissions: publish-github already has contents: write and only differs in whether the step runs; no new privilege.
• Verified your fork repro: run 38838067414 (workflow_dispatch, head_branch=v2.1.16-npmfix) shows the attach step success.

⚠️ Correction to "Note on existing releases"

unless this workflow is dispatched again on those tag refs after the fix lands

This won't work: workflow_dispatch --ref v2.1.16 loads the workflow YAML as committed at that tag, which still contains the old event_name == 'push' condition — the step stays skipped. Backfilling v2.1.16/v2.1.17 needs one of:

1. Download the retained npm-tarballs artifact from those old runs (v2.1.16's is available until 2026-10-20), rebuild the zip with scripts/npm/offline-install.mjs, and gh release upload v2.1.16 codex-proxy-npm.zip;
2. or a temporary workflow on a branch (using inputs.tag) that uploads to the given tag.

Worth correcting the PR note (and/or adding a short backfill note to the changelog) so nobody re-dispatches and concludes it's unfixable.

Minor / non-blocking

• A fork that dispatches on a tag without a GitHub Release now fails the job after ~2 min of retries instead of skipping. If that matters, gate with github.repository == 'icebear0828/codex-proxy'; otherwise fine.
• For consistency with the Resolve package version step in the same file, github.ref_type == 'tag' reads a bit clearer than startsWith(github.ref, 'refs/tags/') — functionally equivalent.

Approving; nothing here blocks the merge.