ci: fix release pipeline - chain publish after release-please

- Chain npm publish directly in release-please workflow (GITHUB_TOKEN events don't trigger other workflows)
- Add release script with safety checks
- Gate release-please on CI success
- Include README in publish
- Use bun runtime for example scripts

Author: DanielFGray

.github/workflows/ci.yml

@@ -8,8 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   test:
@@ -43,58 +42,3 @@ jobs:
 
       - name: Build
         run: bun run build
-
-  release-please:
-    name: Release Please
-    needs: test
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-    steps:
-      - uses: googleapis/release-please-action@v4
-        id: release
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
-          target-branch: main
-
-  publish:
-    name: Publish to npm
-    needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
-        with:
-          bun-version: latest
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Build workspace dependencies
-        run: bun run build
-        working-directory: packages/pg-introspection
-
-      - name: Build pg-sourcerer
-        run: bun run build
-        working-directory: packages/pg-sourcerer
-
-      - name: Publish pg-introspection to npm
-        working-directory: packages/pg-introspection
-        run: bun publish --access public --tolerate-republish
-        env:
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish pg-sourcerer to npm
-        working-directory: packages/pg-sourcerer
-        run: bun publish --access public --tolerate-republish
-        env:
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-please.yml

@@ -0,0 +1,68 @@
+name: Release Please
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release-please:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+          target-branch: main
+
+  publish:
+    name: Publish to npm
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build workspace dependencies
+        run: bun run build
+        working-directory: packages/pg-introspection
+
+      - name: Build pg-sourcerer
+        run: bun run build
+        working-directory: packages/pg-sourcerer
+
+      - name: Publish pg-introspection to npm
+        working-directory: packages/pg-introspection
+        run: bun publish --access public --tolerate-republish
+        env:
+          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish pg-sourcerer to npm
+        working-directory: packages/pg-sourcerer
+        run: |
+          cp ../../README.md ./README.md
+          cp ../../LICENSE ./LICENSE
+          bun publish --access public --tolerate-republish
+          rm ./README.md ./LICENSE
+        env:
+          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-please-manifest.json

@@ -1,3 +1 @@
-{
-  "packages/pg-sourcerer": "0.5.0"
-}
+{"packages/pg-sourcerer": "0.5.0"}

packages/example/package.json

@@ -4,13 +4,13 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dry": "bun --env-file=.env pgsourcerer generate --log-level debug --dry-run",
+    "dry": "bun -b --env-file=.env pgsourcerer generate --log-level debug --dry-run",
     "dev": "bun run-p db:watch generate:watch",
     "start": "bun run generate",
-    "generate": "bun --env-file=.env pgsourcerer generate --log-level debug",
+    "generate": "bun -b --env-file=.env pgsourcerer generate --log-level debug",
     "generate:watch": "bun --env-file=.env --watch pgsourcerer generate --log-level debug",
     "predev": "bun db:ensure",
-    "gm": "bun --env-file=.env ../../node_modules/.bin/graphile-migrate",
+    "gm": "bun -b graphile-migrate",
     "db:ensure": "bun scripts/dbEnsure.ts",
     "db:setup": "bun scripts/dbSetup.ts",
     "db:latest": "bun run gm watch --once",