Releasing: Patching and Rollback

.github/workflows/release-change-tags.yml

@@ -0,0 +1,55 @@
+name: 'Release: Change Tags'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The package version to tag (e.g., 0.5.0-preview-2). This version must already exist on the npm registry.'
+        required: true
+        type: 'string'
+      channel:
+        description: 'The npm dist-tag to apply (e.g., preview, stable).'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+          - 'nightly'
+      dry_run:
+        description: 'Whether to run in dry-run mode.'
+        required: false
+        type: 'boolean'
+        default: true
+
+jobs:
+  change-tags:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://wombat-dressing-room.appspot.com'
+          scope: '@google'
+
+      - name: 'Change tag for @google/gemini-cli-core'
+        if: 'github.event.inputs.dry_run == false'
+        env:
+          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+        run: |
+          npm dist-tag add @google/gemini-cli-core@${{ github.event.inputs.version }} ${{ github.event.inputs.channel }}
+
+      - name: 'Change tag for @google/gemini-cli'
+        if: 'github.event.inputs.dry_run == false'
+        env:
+          NODE_AUTH_TOKEN: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+        run: |
+          npm dist-tag add @google/gemini-cli@${{ github.event.inputs.version }} ${{ github.event.inputs.channel }}
+
+      - name: 'Log dry run'
+        if: 'github.event.inputs.dry_run == true'
+        run: |
+          echo "Dry run: Would have added tag '${{ github.event.inputs.channel }}' to version '${{ github.event.inputs.version }}' for @google/gemini-cli and @google/gemini-cli-core."

.github/workflows/release-manual.yml

@@ -0,0 +1,80 @@
+name: 'Release: Manual'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to release (e.g., v0.1.11). Must be a valid semver string with a "v" prefix.'
+        required: true
+        type: 'string'
+      ref:
+        description: 'The branch, tag, or SHA to release from.'
+        required: true
+        type: 'string'
+      npm_channel:
+        description: 'The npm channel to publish to.'
+        required: true
+        type: 'choice'
+        options:
+          - 'stable'
+          - 'preview'
+          - 'dev'
+      dry_run:
+        description: 'Run a dry-run of the release process; no branches, npm packages or GitHub releases will be created.'
+        required: true
+        type: 'boolean'
+        default: true
+      force_skip_tests:
+        description: 'Select to skip the "Run Tests" step in testing. Prod releases should run tests'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  release:
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      packages: 'write'
+      issues: 'write'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        with:
+          ref: '${{ github.event.inputs.ref }}'
+          fetch-depth: 0
+
+      - name: 'Setup Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: 'Install Dependencies'
+        run: 'npm ci'
+
+      - name: 'Prepare Release Info'
+        id: 'release_info'
+        run: |
+          RELEASE_VERSION="${{ github.event.inputs.version }}"
+          echo "RELEASE_VERSION=${RELEASE_VERSION#v}" >> "${GITHUB_OUTPUT}"
+          echo "PREVIOUS_TAG=$(git describe --tags --abbrev=0)" >> "${GITHUB_OUTPUT}"
+
+      - name: 'Run Tests'
+        if: |-
+          ${{ github.event.inputs.force_skip_tests != true }}
+        uses: './.github/actions/run-tests'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+
+      - name: 'Publish Release'
+        uses: './.github/actions/publish-release'
+        with:
+          release-version: '${{ steps.release_info.outputs.RELEASE_VERSION }}'
+          release-tag: '${{ github.event.inputs.version }}'
+          npm-tag: '${{ github.event.inputs.npm_channel }}'
+          wombat-token-core: '${{ secrets.WOMBAT_TOKEN_CORE }}'
+          wombat-token-cli: '${{ secrets.WOMBAT_TOKEN_CLI }}'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          dry-run: '${{ github.event.inputs.dry_run }}'
+          previous-tag: '${{ steps.release_info.outputs.PREVIOUS_TAG }}'

.github/workflows/nightly-release.yml → .github/workflows/release-nightly.yml

@@ -1,4 +1,4 @@
-name: 'Nightly Release'
+name: 'Release: Nightly'
 
 on:
   schedule:

.github/workflows/create-patch-pr.yml → .github/workflows/release-patch-1-create-pr.yml

@@ -1,4 +1,4 @@
-name: 'Create Patch PR'
+name: 'Release: Patch (1) Create PR'
 
 on:
   workflow_dispatch:
@@ -19,6 +19,11 @@ on:
         required: false
         type: 'boolean'
         default: false
+      ref:
+        description: 'The branch, tag, or SHA to test from.'
+        required: false
+        type: 'string'
+        default: 'main'
 
 jobs:
   create-patch:
@@ -30,6 +35,7 @@ jobs:
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
         with:
+          ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
 
       - name: 'Setup Node.js'

.github/workflows/release-patch-2-trigger.yml

@@ -0,0 +1,65 @@
+name: 'Release: Patch (2) Trigger'
+
+on:
+  pull_request:
+    types:
+      - 'closed'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The head ref of the merged hotfix PR to trigger the release for (e.g. hotfix/v1.2.3/cherry-pick-abc).'
+        required: true
+        type: 'string'
+      workflow_id:
+        description: 'The workflow to trigger. Defaults to patch-release.yml'
+        required: false
+        type: 'string'
+        default: 'release-patch-3-release.yml'
+      dry_run:
+        description: 'Whether this is a dry run.'
+        required: false
+        type: 'boolean'
+        default: false
+
+jobs:
+  trigger-patch-release:
+    if: "(github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'hotfix/')) || github.event_name == 'workflow_dispatch'"
+    runs-on: 'ubuntu-latest'
+    permissions:
+      actions: 'write'
+    steps:
+      - name: 'Trigger Patch Release'
+        uses: 'actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325'
+        with:
+          script: |
+            let body = '';
+            let headRef = '';
+
+            if (context.eventName === 'pull_request') {
+              body = context.payload.pull_request.body;
+              headRef = context.payload.pull_request.head.ref;
+            } else { // workflow_dispatch
+              body = ${{ github.event.inputs.dry_run }} ? '[DRY RUN]' : '';
+              headRef = '${{ github.event.inputs.ref }}';
+            }
+
+            const isDryRun = body.includes('[DRY RUN]');
+            const version = headRef.split('/')[1];
+            const channel = version.includes('preview') ? 'preview' : 'stable';
+            const ref = `release/${version}`;
+            const workflow_id = context.eventName === 'pull_request'
+              ? 'release-patch-3-release.yml'
+              : '${{ github.event.inputs.workflow_id }}';
+
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: workflow_id,
+              ref: 'mk-patch-releases',
+              inputs: {
+                type: channel,
+                dry_run: isDryRun.toString(),
+                version: version,
+                release_ref: ref
+              }
+            })