Moved release automation from Ghost-Release into Ghost monorepo

ref https://linear.app/ghost/issue/BER-3313/

Consolidates the Ghost-Release private repo into the Ghost monorepo.
The release orchestration (version bumping, theme updates, tag creation)
becomes scripts/release.js, triggered by a workflow_dispatch + scheduled
workflow in release.yml. Tag-triggered npm publishing via OIDC and
GitHub Release creation are absorbed into ci.yml, eliminating the
redundant full rebuild that Ghost-Release performed. The npm package
published to self-hosters is now the same artifact that CI tested.

Author: rob-ghost

.github/workflows/ci.yml

@@ -9,6 +9,8 @@ on:
       - main
       - 'v[0-9]+.*' # Matches any release branch, e.g. v6.0.3, v12.1.0
       - '[0-9]+.x' # Matches any major version branch, e.g. 5.x, 23.x
+    tags:
+      - 'v[0-9]*' # Version tags trigger release publishing (npm, GitHub Release)
 
 env:
   FORCE_COLOR: 1
@@ -39,6 +41,7 @@ jobs:
     timeout-minutes: 15
     env:
       IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
+      IS_TAG: ${{ startsWith(github.ref, 'refs/tags/v') }}
       IS_DEVELOPMENT: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/5.x' || github.ref == 'refs/heads/6.x' }}
       IS_SIX: ${{ github.ref == 'refs/heads/6.x' }}
       IS_SIX_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == '6.x' }}
@@ -212,6 +215,7 @@ jobs:
       changed_new_package: ${{ steps.added.outputs.new-package }}
       base_commit: ${{ env.BASE_COMMIT }}
       is_main: ${{ env.IS_MAIN }}
+      is_tag: ${{ env.IS_TAG }}
       is_development: ${{ env.IS_DEVELOPMENT }}
       is_six: ${{ env.IS_SIX }}
       is_six_pr: ${{ env.IS_SIX_PR }}
@@ -245,7 +249,7 @@ jobs:
   job_lint:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_any_code == 'true'
+    if: needs.job_setup.outputs.changed_any_code == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: Lint
     steps:
       - uses: actions/checkout@v6
@@ -281,11 +285,12 @@ jobs:
     needs: [job_setup]
     name: i18n
     if: |
-        needs.job_setup.outputs.changed_comments_ui == 'true'
+        needs.job_setup.outputs.is_tag != 'true'
+        && (needs.job_setup.outputs.changed_comments_ui == 'true'
         || needs.job_setup.outputs.changed_signup_form == 'true'
         || needs.job_setup.outputs.changed_sodo_search == 'true'
         || needs.job_setup.outputs.changed_portal == 'true'
-        || needs.job_setup.outputs.changed_core == 'true'
+        || needs.job_setup.outputs.changed_core == 'true')
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
@@ -303,7 +308,7 @@ jobs:
   job_admin-tests:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_admin == 'true'
+    if: needs.job_setup.outputs.changed_admin == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: Admin tests - Chrome
     env:
       MOZ_HEADLESS: 1
@@ -344,7 +349,7 @@ jobs:
   job_unit-tests:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_any_code == 'true'
+    if: needs.job_setup.outputs.changed_any_code == 'true' && needs.job_setup.outputs.is_tag != 'true'
     strategy:
       matrix:
         node: ${{ fromJSON(needs.job_setup.outputs.node_test_matrix) }}
@@ -404,7 +409,7 @@ jobs:
   job_acceptance-tests:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_core == 'true'
+    if: needs.job_setup.outputs.changed_core == 'true' && needs.job_setup.outputs.is_tag != 'true'
     services:
       mysql:
         image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
@@ -492,7 +497,7 @@ jobs:
   job_legacy-tests:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_core == 'true'
+    if: needs.job_setup.outputs.changed_core == 'true' && needs.job_setup.outputs.is_tag != 'true'
     services:
       mysql:
         image: ${{ matrix.env.DB == 'mysql8' && 'mysql:8.0' || '' }}
@@ -565,7 +570,7 @@ jobs:
   job_admin_x_settings:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_admin_x_settings == 'true'
+    if: needs.job_setup.outputs.changed_admin_x_settings == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: Admin-X Settings tests
     env:
       CI: true
@@ -605,7 +610,7 @@ jobs:
   job_activitypub:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_activitypub == 'true'
+    if: needs.job_setup.outputs.changed_activitypub == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: ActivityPub tests
     env:
       CI: true
@@ -645,7 +650,7 @@ jobs:
   job_comments_ui:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_comments_ui == 'true'
+    if: needs.job_setup.outputs.changed_comments_ui == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: Comments-UI tests
     env:
       CI: true
@@ -685,7 +690,7 @@ jobs:
   job_signup_form:
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_signup_form == 'true'
+    if: needs.job_setup.outputs.changed_signup_form == 'true' && needs.job_setup.outputs.is_tag != 'true'
     name: Signup-form tests
     env:
       CI: true
@@ -726,7 +731,7 @@ jobs:
     name: Tinybird Tests
     runs-on: ubuntu-latest
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_tinybird == 'true'
+    if: needs.job_setup.outputs.changed_tinybird == 'true' && needs.job_setup.outputs.is_tag != 'true'
     defaults:
         run:
           working-directory: ghost/core/core/server/data/tinybird
@@ -756,7 +761,7 @@ jobs:
   job_ghost-cli:
     name: Ghost-CLI tests
     needs: [job_setup]
-    if: needs.job_setup.outputs.changed_core == 'true'
+    if: needs.job_setup.outputs.changed_core == 'true' && needs.job_setup.outputs.is_tag != 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -814,8 +819,8 @@ jobs:
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
-  job_docker_build_production:
-    name: Build & Push Production Docker Images
+  job_build_artifacts:
+    name: Build & Publish Artifacts
     needs: [job_setup]
     runs-on: ubuntu-latest
     permissions:
@@ -848,9 +853,33 @@ jobs:
           fi
           yarn build:production
 
+      - name: Verify tag matches package.json
+        if: startsWith(github.ref, 'refs/tags/v')
+        working-directory: ghost/core
+        run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} doesn't match package.json version ${PKG_VERSION}"
+            exit 1
+          fi
+
       - name: Pack standalone distribution
         run: yarn workspace ghost pack:standalone
 
+      - name: Create npm tarball
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: yarn workspace ghost pack:tarball
+
+      - name: Upload npm tarball
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: actions/upload-artifact@v4
+        with:
+          name: ghost-npm-tarball
+          path: ghost/core/ghost-*.tgz
+          retention-days: 7
+          if-no-files-found: error
+
       - name: Prepare Docker build context
         run: mv ghost/core/package/ /tmp/ghost-production/
 
@@ -882,6 +911,12 @@ jobs:
             IMAGE_FULL_NAME="ghcr.io/${OWNER}/${REPO_NAME}"
           fi
 
+          # Force push on tag pushes (release images must always be published)
+          IS_TAG="${{ startsWith(github.ref, 'refs/tags/v') }}"
+          if [ "$IS_TAG" = "true" ]; then
+            USE_ARTIFACT="false"
+          fi
+
           echo "use-artifact=$USE_ARTIFACT" >> $GITHUB_OUTPUT
           echo "should-push=$( [ "$USE_ARTIFACT" = "false" ] && echo "true" || echo "false" )" >> $GITHUB_OUTPUT
           echo "owner=$OWNER" >> $GITHUB_OUTPUT
@@ -917,6 +952,9 @@ jobs:
             type=ref,event=branch
             type=ref,event=pr
             type=sha
+            type=semver,pattern=v{{version}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest,enable={{is_default_branch}}
           labels: |
             org.opencontainers.image.title=Ghost Core
@@ -932,6 +970,9 @@ jobs:
             type=ref,event=branch
             type=ref,event=pr
             type=sha
+            type=semver,pattern=v{{version}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest,enable={{is_default_branch}}
           labels: |
             org.opencontainers.image.title=Ghost
@@ -1041,7 +1082,8 @@ jobs:
   job_e2e_tests:
     name: E2E Tests (${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
     runs-on: ubuntu-latest
-    needs: [job_docker_build_production, job_setup]
+    needs: [job_build_artifacts, job_setup]
+    if: needs.job_setup.outputs.is_tag != 'true'
     strategy:
       fail-fast: true
       matrix:
@@ -1070,8 +1112,8 @@ jobs:
         uses: ./.github/actions/load-docker-image
         id: load
         with:
-          use-artifact: ${{ needs.job_docker_build_production.outputs.use-artifact }}
-          image-tags: ${{ needs.job_docker_build_production.outputs.image-tags }}
+          use-artifact: ${{ needs.job_build_artifacts.outputs.use-artifact }}
+          image-tags: ${{ needs.job_build_artifacts.outputs.image-tags }}
           artifact-name: docker-image-production
 
       - name: Setup Docker Registry Mirrors
@@ -1286,8 +1328,12 @@ jobs:
       - name: Output needs
         run: echo "${{ toJson(needs) }}"
 
+      - name: Pass on tag pushes (tests already ran on branch)
+        if: needs.job_setup.outputs.is_tag == 'true'
+        run: echo "Tag push — tests skipped (already tested on branch commit)"
+
       - name: Check if any required jobs failed or been cancelled
-        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        if: needs.job_setup.outputs.is_tag != 'true' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
         run: |
           echo "One of the dependent jobs have failed or been cancelled. You may need to re-run it." && exit 1
 
@@ -1467,15 +1513,15 @@ jobs:
   # Trigger Pro CD — dispatch to Ghost-Moya cd.yml (runs on main + PRs)
   # --------------------------------------------------------------------------- #
   trigger_cd:
-    needs: [job_setup, job_docker_build_production]
+    needs: [job_setup, job_build_artifacts]
     name: Trigger Pro CD
     runs-on: ubuntu-latest
     if: |
       always()
       && github.repository == 'TryGhost/Ghost'
       && needs.job_setup.result == 'success'
-      && needs.job_docker_build_production.result == 'success'
-      && needs.job_docker_build_production.outputs.use-artifact != 'true'
+      && needs.job_build_artifacts.result == 'success'
+      && needs.job_build_artifacts.outputs.use-artifact != 'true'
     steps:
       - name: Determine dispatch parameters
         id: params
@@ -1506,10 +1552,110 @@ jobs:
           event-type: ghost-artifacts-ready
           client-payload: >-
             {
-              "ref": "${{ github.sha }}",
+              "ref": "${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || github.sha }}",
               "source_repo": "${{ github.repository }}",
               "pr_number": "${{ steps.params.outputs.pr_number }}",
               "deploy": "${{ steps.params.outputs.deploy }}",
-              "admin_artifact_id": "${{ needs.job_docker_build_production.outputs.admin-artifact-id }}",
+              "admin_artifact_id": "${{ needs.job_build_artifacts.outputs.admin-artifact-id }}",
               "admin_artifact_run_id": "${{ github.run_id }}"
             }
+
+  # --------------------------------------------------------------------------- #
+  # Publish Ghost npm package — runs on version tags only (OIDC, no stored token)
+  # --------------------------------------------------------------------------- #
+  publish_ghost:
+    needs: [job_setup, job_build_artifacts]
+    name: Publish Ghost to npm
+    runs-on: ubuntu-latest
+    if: |
+      startsWith(github.ref, 'refs/tags/v')
+      && github.repository == 'TryGhost/Ghost'
+      && needs.job_build_artifacts.result == 'success'
+    environment: npm-release
+    permissions:
+      id-token: write
+    steps:
+      - name: Download npm tarball
+        uses: actions/download-artifact@v4
+        with:
+          name: ghost-npm-tarball
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      # TODO: Remove once Node v24 ships with npm >= 11
+      - name: Install npm v11 (required for OIDC publishing)
+        run: npm install -g npm@11
+
+      - name: Verify tarball contents
+        run: |
+          echo "Tarball contents:"
+          tar -tzf ghost-*.tgz | head -20
+          tar -tzf ghost-*.tgz | grep -q 'package/yarn.lock' || { echo "::error::yarn.lock not found in tarball"; exit 1; }
+
+      - name: Publish to npm
+        run: npm publish ghost-*.tgz --access public
+
+      - uses: tryghost/actions/actions/slack-build@main
+        if: failure()
+        with:
+          status: ${{ job.status }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  # --------------------------------------------------------------------------- #
+  # Create GitHub Release — runs after successful npm publish
+  # --------------------------------------------------------------------------- #
+  create_github_release:
+    needs: [publish_ghost]
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ secrets.CANARY_DOCKER_BUILD }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Resolve previous tag
+        id: prev_tag
+        run: |
+          CURRENT_TAG="${GITHUB_REF_NAME}"
+          # Find the tag immediately before this one (excluding pre-releases)
+          PREV_TAG=$(git tag --list 'v[0-9]*' --sort=-version:refname | grep -v '-' | grep -v "^${CURRENT_TAG}$" | head -n 1)
+          echo "tag=${PREV_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Previous tag: ${PREV_TAG}"
+
+      - name: Generate release notes
+        id: notes
+        run: |
+          node scripts/lib/release-notes.js "${{ steps.prev_tag.outputs.tag }}" "${GITHUB_REF_NAME}" > /tmp/release-notes.md
+          cat /tmp/release-notes.md
+
+      - name: Create GitHub Release
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file /tmp/release-notes.md
+
+      - name: Notify Slack
+        if: always() && steps.notes.outcome == 'success'
+        run: |
+          VERSION="${GITHUB_REF_NAME}"
+          RELEASE_URL="https://github.com/TryGhost/Ghost/releases/tag/${VERSION}"
+          CHANGELOG=$(cat /tmp/release-notes.md | head -c 3000)
+
+          # Build Slack payload
+          PAYLOAD=$(jq -n \
+            --arg text "👻 *Ghost ${VERSION} is loose!* — <${RELEASE_URL}|Release Notes>\n\n${CHANGELOG}" \
+            '{text: $text}')
+
+          curl -sf -X POST \
+            -H 'Content-type: application/json' \
+            --data "${PAYLOAD}" \
+            "${{ secrets.RELEASE_NOTIFICATION_URL }}" || echo "Slack notification failed (non-fatal)"

.github/workflows/deploy-to-staging.yml

@@ -64,9 +64,9 @@ jobs:
               if [ "$CONCLUSION" = "success" ] || [ "$CONCLUSION" = "failure" ]; then
                 # Check if Docker build job specifically succeeded (paginate — CI has 30+ jobs)
                 BUILD_JOB=$(gh api --paginate "repos/${{ github.repository }}/actions/runs/${RUN_ID}/jobs?per_page=100" \
-                  --jq '.jobs[] | select(.name == "Build & Push Production Docker Images") | .conclusion')
+                  --jq '.jobs[] | select(.name == "Build & Publish Artifacts") | .conclusion')
                 if [ -z "$BUILD_JOB" ]; then
-                  echo "::error::Build & Push Production Docker Images job not found in CI run ${RUN_ID}"
+                  echo "::error::Build & Publish Artifacts job not found in CI run ${RUN_ID}"
                   exit 1
                 elif [ "$BUILD_JOB" = "success" ]; then
                   echo "Docker build ready (CI run $RUN_ID)"