Benjamin DiedrichsenandClaude Opus 5
2019626618
`pnpm run release` (scripts/release.mjs, zx + enquirer + commander) replaces the hand sequence of bump, changelog, gate, tag, push. It picks packages from a list annotated with what npmjs already has, computes versions from the manifest, collects notes in $EDITOR seeded with the commits since the package's last tag, and prepends them to CHANGELOG.md in the format release.yml's parser expects. The gate (lint:ci -> typecheck -> test:coverage -> build -> verify-pack) runs against the bumped tree *before* the commit, so a failure leaves nothing to unpick -- it offers to restore instead. Tags go out dependency-first, and each version is polled on npmjs before the next tag is pushed. That polling is what lets release.yml lose its `check linked deps are released` step: the ordering is now enforced before CI ever sees a tag, rather than after. linked-deps.mjs stays as a hand-check. The accepted cost is that a tag pushed some other way is no longer caught. Three things found by running it rather than reading it: - Tags are annotated (`-a -m`). A lightweight tag is rejected outright under tag.forceSignAnnotated, which is set on the machine this was written on. - pnpm 11 forwards the `--` in `pnpm run release -- --dry-run` literally, and commander reads a bare `--` as "the rest are positionals". The script takes no positionals, so it strips it and both spellings work. - Prompts refuse with a message naming the flag that avoids them when stdin is not a TTY, instead of hanging as an unsettled top-level await. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DCzYTAm9QUhvLNr2EpdagJ
307 lines
12 KiB
YAML
307 lines
12 KiB
YAML
# Tag-driven release of a single package.
|
|
#
|
|
# git tag nopy-v1.2.0 && git push origin nopy-v1.2.0
|
|
# git tag nopy-cubes-v1.2.0 && git push origin nopy-cubes-v1.2.0
|
|
# git tag keyman-v1.2.0 && git push origin keyman-v1.2.0
|
|
#
|
|
# The tag is the source of truth for *which* package ships; package.json is the
|
|
# source of truth for the version, and the two must agree or the run fails.
|
|
#
|
|
# Packages that link to each other release dependency-first — `nopy-cubes` before
|
|
# `nopy` — because the linked version is resolved at pack time. The run refuses
|
|
# to publish otherwise.
|
|
# A version with a prerelease part (1.2.0-rc.1) publishes under `next` instead
|
|
# of `latest`.
|
|
#
|
|
# Required secrets:
|
|
# NPM_TOKEN npmjs granular token, read-and-write on @bitsquare/*, 2FA
|
|
# not required. Expires after 90 days — rotate it.
|
|
# MYGITEA_NPM_TOKEN Gitea PAT with write:package. The automatic GITEA_TOKEN is
|
|
# a repo-scoped task token and the package registry rejects it.
|
|
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- '*-v*'
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
GITEA_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/npm/
|
|
GITEA_REGISTRY_TOKEN: ${{ secrets.MYGITEA_NPM_TOKEN || secrets.GITEA_TOKEN }}
|
|
NPMJS_REGISTRY: https://registry.npmjs.org/
|
|
NPMJS_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
NPMRC: ${{ github.workspace }}/.npmrc-release
|
|
|
|
steps:
|
|
- name: Check out
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Drop the repo's Gitea scope mapping
|
|
# The committed .npmrc points @bitsquare at Gitea so local work resolves
|
|
# snapshots. It must not survive into a publish job: it is a *project*
|
|
# config, which outranks both the userconfig the steps below write and a
|
|
# `--registry` flag, because `@scope:registry` is more specific than
|
|
# `registry`. Left in place, `pnpm publish --registry <npmjs>` uploads to
|
|
# Gitea and `npm view --registry <npmjs>` answers from Gitea — so the
|
|
# npmjs release silently publishes nowhere and then skips itself.
|
|
# Measured, not assumed. The checkout is disposable; each step below
|
|
# names its registry explicitly anyway.
|
|
run: rm -f .npmrc
|
|
|
|
- name: Resolve the release from the tag
|
|
id: target
|
|
run: |
|
|
set -euo pipefail
|
|
tag="${GITHUB_REF#refs/tags/}"
|
|
pkg="${tag%-v*}"
|
|
version="${tag##*-v}"
|
|
dir="packages/${pkg}"
|
|
|
|
if [ ! -f "${dir}/package.json" ]; then
|
|
echo "::error::Tag '${tag}' names package '${pkg}', but ${dir}/package.json does not exist."
|
|
exit 1
|
|
fi
|
|
|
|
declared=$(node -p "require('./${dir}/package.json').version")
|
|
if [ "$declared" != "$version" ]; then
|
|
echo "::error::Tag '${tag}' asks for ${version}, but ${dir}/package.json declares ${declared}. Bump the manifest and re-tag."
|
|
exit 1
|
|
fi
|
|
|
|
name=$(node -p "require('./${dir}/package.json').name")
|
|
case "$version" in
|
|
*-*) dist_tag=next ;;
|
|
*) dist_tag=latest ;;
|
|
esac
|
|
|
|
{
|
|
echo "tag=${tag}"
|
|
echo "dir=${dir}"
|
|
echo "name=${name}"
|
|
echo "version=${version}"
|
|
echo "dist_tag=${dist_tag}"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
echo "Releasing ${name}@${version} from ${dir} as '${dist_tag}'."
|
|
|
|
- name: Check the required secrets are present
|
|
run: |
|
|
set -euo pipefail
|
|
missing=0
|
|
[ -n "${NPMJS_TOKEN}" ] || { echo "::error::NPM_TOKEN secret is not set."; missing=1; }
|
|
[ -n "${GITEA_REGISTRY_TOKEN}" ] || { echo "::error::No Gitea registry token available."; missing=1; }
|
|
exit "$missing"
|
|
|
|
- name: Set up pnpm
|
|
# Version comes from `packageManager` in the root package.json.
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
- name: Locate the pnpm store
|
|
id: pnpm-store
|
|
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Restore the pnpm store
|
|
continue-on-error: true
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: pnpm-${{ runner.os }}-
|
|
|
|
- name: Install
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
# There used to be a *check linked deps are released* step here, refusing
|
|
# to publish a package whose `workspace:` dependency was not yet on npmjs.
|
|
# It was removed: `scripts/release.mjs` is what creates release tags now,
|
|
# and it already pushes them dependency-first and waits for each version to
|
|
# resolve on npmjs before pushing the next — so the ordering is enforced
|
|
# before CI ever sees a tag, rather than after. `node scripts/linked-deps.mjs
|
|
# <dir>` still prints what a package would bake in, if you want to check by
|
|
# hand. A tag pushed some other way is no longer caught.
|
|
|
|
- name: Lint
|
|
run: pnpm run lint:ci
|
|
|
|
- name: Typecheck
|
|
run: pnpm run typecheck
|
|
|
|
- name: Test with coverage
|
|
run: pnpm run test:coverage
|
|
|
|
- name: Build
|
|
# Explicit, so the publish steps can skip lifecycle scripts entirely.
|
|
run: pnpm run build
|
|
|
|
- name: Stamp the commit into the manifest
|
|
# What `nopy --version` annotates itself with. The version is untouched:
|
|
# this only adds a `buildInfo.commit` key, which npm ignores and which
|
|
# ships regardless of `files` because package.json is always packed.
|
|
# Before the pack below, so the artefact under test is the one publish
|
|
# ships. The tree is left dirty, which is why both publish steps pass
|
|
# --no-git-checks — they already did, for the detached HEAD.
|
|
env:
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
short_sha=$(git rev-parse --short=7 HEAD)
|
|
(cd "$DIR" && npm pkg set "buildInfo.commit=${short_sha}")
|
|
|
|
- name: Verify the packed manifests
|
|
# Packages link to each other with `workspace:*`, which npm cannot
|
|
# install. Proves on the tarball that pack rewrote it.
|
|
run: node scripts/verify-pack.mjs
|
|
|
|
- name: Publish to the Gitea registry
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -m 600 /dev/null "$NPMRC"
|
|
{
|
|
printf '@bitsquare:registry=%s\n' "$GITEA_REGISTRY"
|
|
printf '//%s:_authToken=%s\n' "${GITEA_REGISTRY#*://}" "$GITEA_REGISTRY_TOKEN"
|
|
} >> "$NPMRC"
|
|
export npm_config_userconfig="$NPMRC"
|
|
|
|
if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$GITEA_REGISTRY" >/dev/null 2>&1; then
|
|
echo "${NAME}@${VERSION} is already on Gitea — skipping."
|
|
else
|
|
# pnpm, not npm: npm ships `workspace:*` verbatim and the install
|
|
# then fails with EUNSUPPORTEDPROTOCOL. --no-git-checks because a
|
|
# tag build is a detached HEAD.
|
|
#
|
|
# The registry is named as `--@bitsquare:registry`, not `--registry`.
|
|
# Every package here is scoped, and for a scoped package npm resolves
|
|
# `@scope:registry` ahead of `registry` — so a bare flag loses to any
|
|
# project .npmrc that sets the scoped key.
|
|
(cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --@bitsquare:registry="$GITEA_REGISTRY")
|
|
fi
|
|
|
|
- name: Publish to npmjs
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -m 600 /dev/null "$NPMRC"
|
|
{
|
|
printf '@bitsquare:registry=%s\n' "$NPMJS_REGISTRY"
|
|
printf '//%s:_authToken=%s\n' "${NPMJS_REGISTRY#*://}" "$NPMJS_TOKEN"
|
|
} >> "$NPMRC"
|
|
export npm_config_userconfig="$NPMRC"
|
|
|
|
if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$NPMJS_REGISTRY" >/dev/null 2>&1; then
|
|
echo "${NAME}@${VERSION} is already on npmjs — skipping."
|
|
else
|
|
# No --provenance: that needs GitHub Actions OIDC, which Gitea has no
|
|
# equivalent for.
|
|
#
|
|
# Scoped flag, as above — and it matters most here. With a bare
|
|
# `--registry` this line was measured uploading to Gitea whenever a
|
|
# project .npmrc mapped the scope, which is the one mistake npmjs
|
|
# will not let you take back.
|
|
(cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --access public --@bitsquare:registry="$NPMJS_REGISTRY")
|
|
fi
|
|
|
|
- name: Remove the registry credentials
|
|
if: always()
|
|
run: rm -f "$NPMRC"
|
|
|
|
- name: Create the Gitea release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
TAG: ${{ steps.target.outputs.tag }}
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"
|
|
|
|
status=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: token ${GITEA_TOKEN}" "${api}/tags/${TAG}")
|
|
if [ "$status" = "200" ]; then
|
|
echo "A release for ${TAG} already exists — leaving it alone."
|
|
exit 0
|
|
fi
|
|
|
|
# The section of the hand-written changelog that names this version.
|
|
notes=""
|
|
if [ -f "${DIR}/CHANGELOG.md" ]; then
|
|
notes=$(awk -v v="$VERSION" '
|
|
/^## / { if (found) exit; if (index($0, v)) { found = 1; next } }
|
|
found { print }
|
|
' "${DIR}/CHANGELOG.md")
|
|
fi
|
|
export NOTES="$notes"
|
|
|
|
node -e '
|
|
const { NAME, VERSION, TAG, DIST_TAG, NOTES } = process.env;
|
|
const install =
|
|
DIST_TAG === "latest"
|
|
? `npm install -g ${NAME}`
|
|
: `npm install -g ${NAME}@${VERSION}`;
|
|
const body = [
|
|
NOTES.trim(),
|
|
"",
|
|
"```sh",
|
|
install,
|
|
"```",
|
|
].join("\n").trim();
|
|
console.log(JSON.stringify({
|
|
tag_name: TAG,
|
|
name: `${NAME} v${VERSION}`,
|
|
body,
|
|
draft: false,
|
|
prerelease: DIST_TAG !== "latest",
|
|
}));
|
|
' > release.json
|
|
|
|
curl -sS -f -X POST \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary @release.json \
|
|
"$api"
|
|
rm -f release.json
|
|
|
|
- name: Summarise
|
|
# Reporting only; never the reason a green release goes red.
|
|
continue-on-error: true
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${GITHUB_STEP_SUMMARY:=/dev/null}"
|
|
{
|
|
echo "### Released \`${NAME}@${VERSION}\` (\`${DIST_TAG}\`)"
|
|
echo ""
|
|
echo "- npmjs: \`npm install -g ${NAME}@${VERSION}\`"
|
|
# Scoped, never a bare `--registry`: Gitea serves @bitsquare only and
|
|
# does not proxy npmjs, so a bare flag sends every transitive
|
|
# dependency to a registry that has never heard of them.
|
|
echo "- Gitea: \`npm install -g ${NAME}@${VERSION} --@bitsquare:registry=${GITEA_REGISTRY}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|