[Jason3S]

The v10.4.1 publish failed with EUNCOMMIT. The "Update Sponsor for NPM" step changes tracked files just before publishing. lerna-lite 5.7.0 now enforces its clean working tree check (lerna-lite#1440), which earlier versions never ran.

• Commit the sponsor changes on the runner. The commit is never pushed, so they reach the NPM packages but not main.
• Pass --git-head with the tagged commit, resolved right after checkout, so npm doesn't record the sponsor commit that is lost when the job ends.
• Add an optional tag input to the manual run of publish.yml. Running from the tag is preferred. The input is for runs started from another ref, such as a retry when the tag's own workflow file is broken.
• Fail the run unless a v* tag is checked out, so a manual run can't publish a branch under an unpublished version.
• Remove workflow_call from publish.yml, so another workflow can't call it. The commented-out caller in build-version-release.yml goes too.
• Stop passing PUBLISH_NPM to build-version-release.yml, and remove its id-token: write permission. It no longer publishes, so only publish.yml receives the npm token and the OIDC permission.
• Remove the signing TODO from publish.yml: from-package creates no commit or tag.

The workflow hasn't run yet. In a clone at v10.4.1, the tag check passed, the commit cleared the dirty state from git describe --dirty, which is what the check reads, and the commit resolved after checkout was the tagged commit. The tag check failed on an untagged commit.

[ghiscoding]

@Jason3S I'm adding --allow-dirty CLI option which will help with this new dirty tree check, I understand that the new behaviour is much more strict than before but that is the correct approach nonetheless, so this --allow-dirty will provide you a way to go around the strictness, I also made it accept glob patterns (e.g. allowDirty: ['**/*.md']). I'll publish a new release tomorrow as v5.8.0 (you can see PR linked above for the new feature changes)