Skip to content

Commit f6a2027

Browse files
poadpoad
authored
Fix the Release workflow (#2033)
1 parent 6899b4b commit f6a2027

5 files changed

Lines changed: 160 additions & 55 deletions

File tree

‎.github/workflows/auto-merge.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ on:
44
pull_request:
55

66
permissions:
7-
id-token: write
87
contents: write
98
pull-requests: write
10-
checks: write
119

1210
jobs:
13-
pull-request-auto-merge:
11+
auto-merge:
12+
if: github.event.pull_request.draft == false
13+
1414
runs-on: ubuntu-latest
1515
steps:
1616
- uses: actions/checkout@v5

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,6 @@ on:
99

1010
workflow_dispatch:
1111

12-
permissions:
13-
actions: read
14-
checks: write
15-
contents: none
16-
deployments: none
17-
issues: none
18-
packages: none
19-
repository-projects: none
20-
statuses: write
21-
2212
jobs:
2313
build:
2414
runs-on: ubuntu-latest

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,24 +20,16 @@ on:
2020
schedule:
2121
- cron: '34 3 * * 1'
2222

23-
permissions:
24-
actions: read
25-
checks: write
26-
contents: none
27-
deployments: none
28-
issues: none
29-
packages: none
30-
repository-projects: none
31-
statuses: write
3223

3324
jobs:
3425
analyze:
3526
name: Analyze
3627
runs-on: ubuntu-latest
3728
permissions:
29+
security-events: write
30+
packages: read
3831
actions: read
3932
contents: read
40-
security-events: write
4133

4234
strategy:
4335
fail-fast: false

‎.github/workflows/create-release-pr.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Create Release Pull Request
2+
description: Create a pull request to release a new version
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
version:
8+
description: 'Version type'
9+
required: true
10+
type: choice
11+
options:
12+
- patch
13+
- minor
14+
- major
15+
16+
jobs:
17+
create-release-pr:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write
21+
pull-requests: write
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
25+
with:
26+
persist-credentials: false
27+
28+
- name: Configure Git
29+
run: |
30+
git config user.name "github-actions[bot]"
31+
git config user.email "github-actions[bot]@users.noreply.github.com"
32+
33+
34+
- name: Setup Node.js
35+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
36+
with:
37+
node-version: 'lts/*'
38+
check-latest: true
39+
package-manager-cache: false
40+
41+
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
42+
with:
43+
run_install: |
44+
- recursive: true
45+
args: [--no-frozen-lockfile]
46+
47+
# No need to install dependencies - npm version works without them
48+
- name: Version bump
49+
id: version
50+
run: |
51+
VERSION=$(pnpm version "$VERSION_TYPE" --no-git-tag-version)
52+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
53+
pnpm --recursive exec pnpm pkg set version=$(node -p "JSON.parse(fs.readFileSync('package.json', 'utf8')).version")
54+
env:
55+
VERSION_TYPE: ${{ github.event.inputs.version }}
56+
57+
- name: Get release notes
58+
id: release-notes
59+
run: |
60+
# Get the default branch
61+
DEFAULT_BRANCH=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.default_branch')
62+
63+
# Get the latest release tag using GitHub API
64+
# Use the exit code to determine if a release exists
65+
if LAST_TAG=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq '.tag_name' 2>/dev/null); then
66+
echo "Previous release found: $LAST_TAG"
67+
else
68+
LAST_TAG=""
69+
echo "No previous releases found - this will be the first release"
70+
fi
71+
72+
# Generate release notes - only include previous_tag_name if we have a valid previous tag
73+
echo "Generating release notes for tag: $VERSION"
74+
if [ -n "$LAST_TAG" ]; then
75+
echo "Using previous tag: $LAST_TAG"
76+
RELEASE_NOTES=$(gh api \
77+
--method POST \
78+
-H "Accept: application/vnd.github+json" \
79+
"/repos/$GITHUB_REPOSITORY/releases/generate-notes" \
80+
-f "tag_name=$VERSION" \
81+
-f "target_commitish=$DEFAULT_BRANCH" \
82+
-f "previous_tag_name=$LAST_TAG" \
83+
--jq '.body')
84+
else
85+
echo "Generating notes from all commits"
86+
RELEASE_NOTES=$(gh api \
87+
--method POST \
88+
-H "Accept: application/vnd.github+json" \
89+
"/repos/$GITHUB_REPOSITORY/releases/generate-notes" \
90+
-f "tag_name=$VERSION" \
91+
-f "target_commitish=$DEFAULT_BRANCH" \
92+
--jq '.body')
93+
fi
94+
95+
# Set release notes as environment variable
96+
echo "RELEASE_NOTES<<EOF" >> "$GITHUB_OUTPUT"
97+
echo "$RELEASE_NOTES" >> "$GITHUB_OUTPUT"
98+
echo "EOF" >> "$GITHUB_OUTPUT"
99+
env:
100+
GH_TOKEN: ${{ github.token }}
101+
VERSION: ${{ steps.version.outputs.version }}
102+
GITHUB_REPOSITORY: ${{ github.repository }}
103+
104+
- name: Create Pull Request
105+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
106+
env:
107+
RELEASE_NOTES: ${{ steps.release-notes.outputs.RELEASE_NOTES }}
108+
VERSION: ${{ steps.version.outputs.version }}
109+
with:
110+
branch: release/${{ steps.version.outputs.version }}
111+
delete-branch: true
112+
title: "Release ${{ steps.version.outputs.version }}"
113+
body: |
114+
${{ env.RELEASE_NOTES }}
115+
commit-message: "chore: release ${{ steps.version.outputs.version }}"
116+
labels: |
117+
Type: Release
118+
assignees: ${{ github.actor }}
119+
draft: true

‎.github/workflows/release.yml‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,60 @@
11
name: Automatic release
22
on:
3-
release:
3+
pull_request:
4+
branches:
5+
- master
6+
- main
47
types:
5-
- published
8+
- closed
69

710
workflow_dispatch:
811

9-
permissions:
10-
actions: read
11-
checks: write
12-
contents: none
13-
deployments: none
14-
issues: none
15-
packages: none
16-
repository-projects: none
17-
statuses: write
18-
1912
jobs:
2013
release:
14+
if: |
15+
github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'Type: Release')
16+
permissions:
17+
contents: write
18+
id-token: write # OIDC
19+
pull-requests: write # PR comment
20+
2121
name: check version, add tag and release
2222
runs-on: ubuntu-latest
2323
steps:
24-
- name: checkout
25-
uses: actions/checkout@v5
24+
- name: Checkout
25+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
26+
with:
27+
persist-credentials: false
2628

27-
- name: setup Node
29+
- name: Setup Node
2830
uses: actions/setup-node@v5
29-
env :
30-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
3131
with:
32-
node-version: 22.x
32+
node-version: 'lts/*'
3333
registry-url: 'https://registry.npmjs.org'
34-
scope : 'appstore-connect-jwt-generator-clie'
35-
always-auth : true
34+
scope : 'appstore-connect-jwt-generator-core'
3635
package-manager-cache: false
3736

38-
- uses: pnpm/action-setup@v4
39-
name: Install pnpm
37+
- name: Can Publish
38+
run : npx can-npm-publish --verbose
39+
working-directory: package
40+
41+
- name: Install latest npm
42+
run: |
43+
echo "Current npm version: $(npm -v)"
44+
npm install -g npm@latest
45+
echo "Updated npm version: $(npm -v)"
46+
47+
- name: Install pnpm
48+
uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
4049
with:
4150
run_install: |
4251
- recursive: true
4352
args: [--no-frozen-lockfile]
44-
45-
- name: Can Publish
46-
run : npx can-npm-publish --verbose
47-
env :
48-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
53+
4954
- name: Build
5055
run : pnpm build
51-
env :
52-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
56+
working-directory: package
57+
5358
- name: Publish
54-
run : npm publish --access=public
55-
env :
56-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
59+
run : pnpm -r publish --no-git-checks --access public --provenance
60+
working-directory: package

0 commit comments

Comments
 (0)