From 46e5010d7e1e845b6bea5fad8fec24e16cbb000e Mon Sep 17 00:00:00 2001
From: Anton Lykhoyda <lykhoyda@gmail.com>
Date: Sun, 31 May 2026 21:57:57 +0200
Subject: [PATCH] ci: automate version bumps via changesets/action (Version-PR
 + auto-merge)

On push to main, opens a "Version Packages" PR that runs version-packages
and auto-merges it, so merged changesets become an installable version bump
without a manual step. No npm publish (marketplace reads the repo manifest).

Also tightens the auto-merge step: PR_NUMBER is passed through an env var
rather than interpolated directly into the shell command, eliminating any
theoretical injection surface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 59 +++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..f1ad01f4
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,59 @@
+name: Release
+
+# Changesets release automation (Version-PR pattern).
+#
+# On every push to main, this opens/updates a "Version Packages" PR that runs
+# `npm run version-packages` (changeset version -> sync-plugin-manifest -> sync-versions --fix),
+# accumulating all pending changesets into one version bump. Merging that PR
+# bumps plugin.json + marketplace.json + cdp-bridge, updates CHANGELOGs, and
+# consumes the changesets — making the new version installable from the marketplace.
+#
+# No npm publish: the "package" is the plugin manifest the marketplace reads
+# from the repo, so only the version half of changesets/action is used.
+#
+# PREREQUISITES (must be enabled in repo settings — cannot be set from this file):
+#   - Settings > Actions > General > "Allow GitHub Actions to create and approve pull requests"
+#   - Settings > General > "Allow auto-merge"
+#   - Branch protection on main with >=1 required status check (so `gh pr merge --auto`
+#     has a check to gate on; otherwise auto-merge has nothing to wait for).
+
+on:
+  push:
+    branches: [main]
+
+concurrency: release-${{ github.ref }}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - run: npm ci
+
+      - name: Create or update the Version Packages PR
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          version: npm run version-packages
+          commit: "chore(release): version packages"
+          title: "chore(release): version packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge on the Version Packages PR
+        if: steps.changesets.outputs.pullRequestNumber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ steps.changesets.outputs.pullRequestNumber }}
+        run: gh pr merge --squash --auto "$PR_NUMBER"