ci: automated release workflow (semantic-release + OIDC trusted publishing) #46
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| name: Setup Node | ||
| description: Setup Node from .nvmrc and install dependencies with npm | ||
| inputs: | ||
| node-version: | ||
| description: Optional Node version override | ||
| required: false | ||
| runs: | ||
| using: composite | ||
| steps: | ||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: ${{ inputs.node-version }} | ||
| node-version-file: .nvmrc | ||
| cache: npm | ||
|
|
||
| - name: Install dependencies | ||
| shell: bash | ||
| run: npm ci # respects .npmrc (legacy-peer-deps=true) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| name: Release | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| dry_run: | ||
| description: Run release in "dry run" mode (does not publish) | ||
| default: false | ||
| type: boolean | ||
|
|
||
| permissions: | ||
| id-token: write # Required for npm Trusted Publishing (OIDC) + provenance | ||
| contents: write # Required to push the changelog/version commit + create the GH Release | ||
|
|
||
| jobs: | ||
| package_release: | ||
| name: Release from "${{ github.ref_name }}" branch | ||
| runs-on: ubuntu-latest | ||
| # GH does not allow limiting branches in workflow_dispatch settings, so guard here. | ||
| if: ${{ inputs.dry_run || github.ref_name == 'master' || github.ref_name == 'beta' || startsWith(github.ref_name, 'release') || endsWith(github.ref_name, '.x') }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 # full history + tags required by semantic-release | ||
|
|
||
| - uses: ./.github/actions/setup-node | ||
|
|
||
| - name: Release | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: > | ||
| npx semantic-release | ||
| ${{ inputs.dry_run && '--dry-run' || '' }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,33 @@ | ||||||||||||||||||
| { | ||||||||||||||||||
| "branches": [ | ||||||||||||||||||
| "+([0-9])?(.{+([0-9]),x}).x", | ||||||||||||||||||
| "master", | ||||||||||||||||||
| { "name": "beta", "prerelease": true } | ||||||||||||||||||
| ], | ||||||||||||||||||
| "plugins": [ | ||||||||||||||||||
| [ | ||||||||||||||||||
| "@semantic-release/commit-analyzer", | ||||||||||||||||||
| { | ||||||||||||||||||
| "preset": "conventionalcommits", | ||||||||||||||||||
| "releaseRules": [ | ||||||||||||||||||
| { "type": "refactor", "release": "patch" }, | ||||||||||||||||||
| { "scope": "deps", "release": "patch" } | ||||||||||||||||||
| ] | ||||||||||||||||||
|
Comment on lines
+12
to
+15
There was a problem hiding this comment. The Line 14 matches any commit with scope 📝 Alternative configuration if type-based versioning should be preserved "releaseRules": [
{ "type": "refactor", "release": "patch" },
- { "scope": "deps", "release": "patch" }
+ { "type": "chore", "scope": "deps", "release": "patch" }
]Or document the current behavior if intentional. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||
| } | ||||||||||||||||||
| ], | ||||||||||||||||||
| [ | ||||||||||||||||||
| "@semantic-release/release-notes-generator", | ||||||||||||||||||
| { "preset": "conventionalcommits" } | ||||||||||||||||||
| ], | ||||||||||||||||||
| ["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }], | ||||||||||||||||||
| "@semantic-release/npm", | ||||||||||||||||||
| [ | ||||||||||||||||||
| "@semantic-release/git", | ||||||||||||||||||
| { | ||||||||||||||||||
| "assets": ["CHANGELOG.md", "package.json", "package-lock.json"], | ||||||||||||||||||
| "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" | ||||||||||||||||||
| } | ||||||||||||||||||
| ], | ||||||||||||||||||
| "@semantic-release/github" | ||||||||||||||||||
| ] | ||||||||||||||||||
| } | ||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Branch guard is more permissive than semantic-release configuration.
Line 19 uses
endsWith(github.ref_name, '.x'), which would allow branches liketest.xorfoo.x. However,.releaserc.jsonLine 3 expects numeric maintenance branches (1.x,2.x,1.0.x). This mismatch could allow releases from unintended branches.🔒 Proposed fix to align with semantic-release branch patterns
Or use a more precise regex check by adding a validation step before the release.
🤖 Prompt for AI Agents