ci(build): Add snapshot release workflow

runningcode · claude · runningcode · commit 9ae8e1dad89b · 2026-03-12T14:04:08.000+01:00
Add a workflow_dispatch-triggered snapshot release pipeline that reuses
the existing build workflow. Snapshot builds skip macOS code signing,
override versions with a snapshot identifier, and publish to npm under
the `snapshot` tag.

- Add `workflow_call` inputs to build.yml for `skip-signing` and
  `snapshot-version`
- Add `override-version` composite action to patch Cargo.toml,
  package.json, and npm-binary-distributions
- Add `snapshot.yml` workflow that computes a snapshot version, triggers
  the build, and publishes to npm
- Skip Python, Docker, and merge jobs for snapshot builds

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/actions/override-version/action.yml b/.github/actions/override-version/action.yml
@@ -0,0 +1,55 @@
+name: Override Version
+description: Patch version strings for snapshot builds
+
+inputs:
+  version:
+    required: true
+    description: The version string to set
+  target:
+    required: true
+    description: 'What to patch: cargo, npm, npm-distributions'
+
+runs:
+  using: composite
+  steps:
+    - name: Patch Cargo.toml and lockfile
+      if: inputs.target == 'cargo'
+      shell: bash
+      run: |
+        VERSION="${{ inputs.version }}"
+
+        sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" Cargo.toml
+        rm -f Cargo.toml.bak
+
+        awk -v ver="$VERSION" '
+          /^name = "sentry-cli"/ { found = 1 }
+          found && /^version = "/ { $0 = "version = \"" ver "\""; found = 0 }
+          { print }
+        ' Cargo.lock > Cargo.lock.tmp && mv Cargo.lock.tmp Cargo.lock
+
+    - name: Patch package.json
+      if: inputs.target == 'npm'
+      shell: bash
+      run: |
+        node -e "
+          const fs = require('fs');
+          const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          pkg.version = '${{ inputs.version }}';
+          for (const dep of Object.keys(pkg.optionalDependencies || {})) {
+            pkg.optionalDependencies[dep] = '${{ inputs.version }}';
+          }
+          fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+        "
+
+    - name: Patch npm binary distribution packages
+      if: inputs.target == 'npm-distributions'
+      shell: bash
+      run: |
+        for pkgjson in npm-binary-distributions/*/package.json; do
+          node -e "
+            const fs = require('fs');
+            const pkg = JSON.parse(fs.readFileSync('$pkgjson', 'utf8'));
+            pkg.version = '${{ inputs.version }}';
+            fs.writeFileSync('$pkgjson', JSON.stringify(pkg, null, 2) + '\n');
+          "
+        done
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -4,6 +4,14 @@ on:
   push:
     branches:
       - release/**
+  workflow_call:
+    inputs:
+      skip-signing:
+        type: boolean
+        default: false
+      snapshot-version:
+        type: string
+        default: ''
 
 jobs:
   linux:
@@ -33,6 +41,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
+      - name: Override version
+        if: ${{ inputs.snapshot-version != '' }}
+        uses: ./.github/actions/override-version
+        with:
+          version: ${{ inputs.snapshot-version }}
+          target: cargo
+
       - name: Add Rustup Target
         run: |
           rustup set profile minimal
@@ -69,6 +84,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
+      - name: Override version
+        if: ${{ inputs.snapshot-version != '' }}
+        uses: ./.github/actions/override-version
+        with:
+          version: ${{ inputs.snapshot-version }}
+          target: cargo
+
       - name: Add Rustup Target
         run: rustup target add ${{ matrix.target }}
 
@@ -154,9 +176,11 @@ jobs:
 
     steps:
       - name: Checkout repository
+        if: ${{ !inputs.skip-signing }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
       - name: Install `rcodesign`
+        if: ${{ !inputs.skip-signing }}
         run: |
           curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.29.0/apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz \
             -o rcodesign.tar.gz
@@ -166,6 +190,7 @@ jobs:
           rm rcodesign.tar.gz
 
       - name: Decode Apple signing certificate and API key
+        if: ${{ !inputs.skip-signing }}
         env:
           APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
@@ -179,6 +204,7 @@ jobs:
           name: unsigned-bin-macos-${{ matrix.arch }}
 
       - name: Sign binary
+        if: ${{ !inputs.skip-signing }}
         run: |
           rcodesign sign \
             --for-notarization \
@@ -188,17 +214,19 @@ jobs:
             sentry-cli-Darwin-${{ matrix.arch }}
 
       - name: Zip signed binary
+        if: ${{ !inputs.skip-signing }}
         run: |
           zip sentry-cli-Darwin-${{ matrix.arch }}.zip sentry-cli-Darwin-${{ matrix.arch }}
 
       - name: Notarize binary
+        if: ${{ !inputs.skip-signing }}
         run: |
           rcodesign notary-submit \
             --api-key-file ${{ env.APPLE_API_KEY_PATH }} \
             --wait \
             sentry-cli-Darwin-${{ matrix.arch }}.zip
 
-      - name: Upload signed binary
+      - name: Upload binary
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
         with:
           name: artifact-bin-macos-${{ matrix.arch }}
@@ -220,6 +248,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
+      - name: Override version
+        if: ${{ inputs.snapshot-version != '' }}
+        uses: ./.github/actions/override-version
+        with:
+          version: ${{ inputs.snapshot-version }}
+          target: cargo
+
       # When rustup is updated, it tries to replace its binary, which on Windows is somehow locked.
       # This can result in the CI failure, see: https://github.com/rust-lang/rustup/issues/3029
       - name: Disable rustup self-update
@@ -259,6 +294,13 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Override version
+        if: ${{ inputs.snapshot-version != '' }}
+        uses: ./.github/actions/override-version
+        with:
+          version: ${{ inputs.snapshot-version }}
+          target: npm
+
       - name: Download compiled binaries
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
         with:
@@ -280,6 +322,7 @@ jobs:
           if-no-files-found: 'error'
 
   python-base:
+    if: ${{ !inputs.snapshot-version }}
     name: python (base)
     runs-on: ubuntu-24.04
     steps:
@@ -297,6 +340,7 @@ jobs:
           if-no-files-found: 'error'
 
   python:
+    if: ${{ !inputs.snapshot-version }}
     name: python
     runs-on: ubuntu-24.04
     needs: [linux, sign-macos-binaries, windows, python-base]
@@ -331,6 +375,12 @@ jobs:
       - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
         with:
           node-version: '20.10.0'
+      - name: Override version
+        if: ${{ inputs.snapshot-version != '' }}
+        uses: ./.github/actions/override-version
+        with:
+          version: ${{ inputs.snapshot-version }}
+          target: npm-distributions
       - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
         with:
           pattern: artifact-bin-*
@@ -366,6 +416,7 @@ jobs:
           if-no-files-found: 'error'
 
   platform-specific-docker:
+    if: ${{ !inputs.snapshot-version }}
     name: Build Docker Image (${{ matrix.platform }})
     strategy:
       matrix:
@@ -402,6 +453,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
 
   multiarch-docker:
+    if: ${{ !inputs.snapshot-version }}
     name: Create Multi-Architecture Docker Image
     needs: platform-specific-docker
     runs-on: ubuntu-24.04
@@ -422,6 +474,7 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64
 
   merge:
+    if: ${{ !inputs.snapshot-version }}
     name: Create Release Artifact
     runs-on: ubuntu-24.04
     needs: [linux, sign-macos-binaries, windows, npm-distributions, node, python]
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
@@ -0,0 +1,72 @@
+name: Snapshot Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  compute-version:
+    name: Compute Snapshot Version
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+
+      - name: Compute snapshot version
+        id: version
+        run: |
+          CURRENT=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+          MAJOR=$(echo "$CURRENT" | cut -d. -f1)
+          MINOR=$(echo "$CURRENT" | cut -d. -f2)
+          NEXT_MINOR=$((MINOR + 1))
+          DATE=$(date -u +%Y%m%d)
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          VERSION="${MAJOR}.${NEXT_MINOR}.0-snapshot.${DATE}.${SHORT_SHA}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Snapshot version: $VERSION"
+
+  build:
+    name: Build
+    needs: compute-version
+    uses: ./.github/workflows/build.yml
+    with:
+      skip-signing: true
+      snapshot-version: ${{ needs.compute-version.outputs.version }}
+    secrets: inherit
+
+  publish-npm:
+    name: Publish to npm
+    needs: [compute-version, build]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
+        with:
+          node-version: '20.10.0'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download npm binary distributions
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
+        with:
+          name: artifact-npm-binary-distributions
+          path: npm-distributions
+
+      - name: Download node package
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
+        with:
+          name: artifact-pkg-node
+          path: node-package
+
+      - name: Publish platform packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          for pkg in npm-distributions/*.tgz; do
+            echo "Publishing $pkg"
+            npm publish "$pkg" --tag snapshot
+          done
+
+      - name: Publish main package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          npm publish node-package/*.tgz --tag snapshot
