From f44244d4b532b9159ed20bef2a0b706b0c8fbe4d Mon Sep 17 00:00:00 2001
From: Justin Scroggins <60281870+itz4blitz@users.noreply.github.com>
Date: Sun, 6 Sep 2026 12:29:51 -0400
Subject: [PATCH] fix(ci): stamp the release commit so GitHub does not show
 pending

semantic-release pushes master with GITHUB_TOKEN, which cannot start
a new workflow. After publish, mark origin/master success so the
repo HEAD is green.
---
 .github/workflows/pipeline.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index f7832ba..8c685d3 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -202,6 +202,7 @@ jobs:
       contents: write
       id-token: write
       issues: write
+      statuses: write
 
     steps:
       - name: Checkout code
@@ -243,6 +244,24 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ALLOW_MISSING_INITIAL_NPM_TOKEN: 'true'
 
+      # GITHUB_TOKEN pushes do not trigger workflows, so the release commit
+      # would otherwise sit on master with no checks (repo looks red/pending).
+      - name: Mark release HEAD as success
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          SHA=$(git ls-remote origin refs/heads/master | awk '{print $1}')
+          if [ -z "$SHA" ]; then
+            echo "Could not resolve origin/master"
+            exit 1
+          fi
+          gh api "repos/${{ github.repository }}/statuses/${SHA}" \
+            -f state=success \
+            -f context='CI/CD Pipeline' \
+            -f description='Release commit already validated' \
+            -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
   # ============================================================================
   # STAGE 4: POST-PUBLISH SMOKE TESTS
   # ============================================================================