jupyter-server-proxy 3.2.1 post-release

[manics]

I just released jupyter-server-proxy 3.2.1 (security fix) and ran into a few problems:

CI tests aren't run in private security branches

I merged the security branch, pushed a new commit updating the version in jupyterlab-server-proxy/package.json, and pushed to main. before tagging I noticed the tests failed due to a minor error, fixed in jupyterhub/jupyter-server-proxy#317

Maybe worth a note in a security/release doc somewhere as a reminder?

GitHub workflows for tags are disabled

I pushed a v3.2.1 tag but workflows weren't run.
This is because on.push.branches-ignore was added in jupyterhub/jupyter-server-proxy#310 but this means tags are excluded: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore

If you define only tags/tag-ignore or only branches/branches-ignore, the workflow won't run for events affecting the undefined Git ref.

I deleted the tag, added jupyterhub/jupyter-server-proxy#318 and pushed a new tag.

Does this affect any other repos?

[minrk]

Probably a general doc for security releases is a good idea on team-compass (I don't think it will differ much across repos).

The tag-trigger is hard to catch any other way than making a release. Maybe we can run a quick check across release workflows?