Fix the Release workflow and support npx #2034
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,16 +9,6 @@ on: | |
|
|
||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| name: Create Release Pull Request | ||
| description: Create a pull request to release a new version | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: 'Version type' | ||
| required: true | ||
| type: choice | ||
| options: | ||
| - patch | ||
| - minor | ||
| - major | ||
|
|
||
| jobs: | ||
| create-release-pr: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Configure Git | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
|
|
||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 | ||
| with: | ||
| node-version: 'lts/*' | ||
| check-latest: true | ||
| package-manager-cache: false | ||
|
|
||
| - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | ||
| with: | ||
| run_install: | | ||
| - recursive: true | ||
| args: [--no-frozen-lockfile] | ||
|
|
||
| # No need to install dependencies - npm version works without them | ||
| - name: Version bump | ||
| id: version | ||
| run: | | ||
| VERSION=$(pnpm version "$VERSION_TYPE" --no-git-tag-version) | ||
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | ||
| pnpm --recursive exec pnpm pkg set version=$(node -p "JSON.parse(fs.readFileSync('package.json', 'utf8')).version") | ||
| env: | ||
| VERSION_TYPE: ${{ github.event.inputs.version }} | ||
|
|
||
| - name: Get release notes | ||
| id: release-notes | ||
| run: | | ||
| # Get the default branch | ||
| DEFAULT_BRANCH=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.default_branch') | ||
|
|
||
| # Get the latest release tag using GitHub API | ||
| # Use the exit code to determine if a release exists | ||
| if LAST_TAG=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq '.tag_name' 2>/dev/null); then | ||
| echo "Previous release found: $LAST_TAG" | ||
| else | ||
| LAST_TAG="" | ||
| echo "No previous releases found - this will be the first release" | ||
| fi | ||
|
|
||
| # Generate release notes - only include previous_tag_name if we have a valid previous tag | ||
| echo "Generating release notes for tag: $VERSION" | ||
| if [ -n "$LAST_TAG" ]; then | ||
| echo "Using previous tag: $LAST_TAG" | ||
| RELEASE_NOTES=$(gh api \ | ||
| --method POST \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "/repos/$GITHUB_REPOSITORY/releases/generate-notes" \ | ||
| -f "tag_name=$VERSION" \ | ||
| -f "target_commitish=$DEFAULT_BRANCH" \ | ||
| -f "previous_tag_name=$LAST_TAG" \ | ||
| --jq '.body') | ||
| else | ||
| echo "Generating notes from all commits" | ||
| RELEASE_NOTES=$(gh api \ | ||
| --method POST \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "/repos/$GITHUB_REPOSITORY/releases/generate-notes" \ | ||
| -f "tag_name=$VERSION" \ | ||
| -f "target_commitish=$DEFAULT_BRANCH" \ | ||
| --jq '.body') | ||
| fi | ||
|
|
||
| # Set release notes as environment variable | ||
| echo "RELEASE_NOTES<<EOF" >> "$GITHUB_OUTPUT" | ||
| echo "$RELEASE_NOTES" >> "$GITHUB_OUTPUT" | ||
| echo "EOF" >> "$GITHUB_OUTPUT" | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| VERSION: ${{ steps.version.outputs.version }} | ||
| GITHUB_REPOSITORY: ${{ github.repository }} | ||
|
|
||
| - name: Create Pull Request | ||
| uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 | ||
| env: | ||
| RELEASE_NOTES: ${{ steps.release-notes.outputs.RELEASE_NOTES }} | ||
| VERSION: ${{ steps.version.outputs.version }} | ||
| with: | ||
| branch: release/${{ steps.version.outputs.version }} | ||
| delete-branch: true | ||
| title: "Release ${{ steps.version.outputs.version }}" | ||
| body: | | ||
| ${{ env.RELEASE_NOTES }} | ||
| commit-message: "chore: release ${{ steps.version.outputs.version }}" | ||
| labels: | | ||
| Type: Release | ||
| assignees: ${{ github.actor }} | ||
| draft: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,60 @@ | ||
| name: Automatic release | ||
| on: | ||
| pull_request: | ||
| branches: | ||
| - master | ||
| - main | ||
| types: | ||
| - closed | ||
|
|
||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| release: | ||
| if: | | ||
| github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'Type: Release') | ||
| permissions: | ||
| contents: write | ||
| id-token: write # OIDC | ||
| pull-requests: write # PR comment | ||
|
|
||
| name: check version, add tag and release | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Setup Node | ||
|
There was a problem hiding this comment. 🛑 [セキュリティ警告] OIDCトークンの使用は適切ですが、最小権限の原則に従って、必要な権限のみを付与するようにpermissionsを制限することを推奨します1。 Footnotes
|
||
| uses: actions/setup-node@v5 | ||
| with: | ||
| node-version: 'lts/*' | ||
| registry-url: 'https://registry.npmjs.org' | ||
| scope : 'appstore-connect-jwt-generator-core' | ||
| package-manager-cache: false | ||
|
|
||
| - name: Can Publish | ||
| run : npx can-npm-publish --verbose | ||
| working-directory: package | ||
|
|
||
| - name: Install latest npm | ||
| run: | | ||
| echo "Current npm version: $(npm -v)" | ||
| npm install -g npm@latest | ||
| echo "Updated npm version: $(npm -v)" | ||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | ||
| with: | ||
| run_install: | | ||
| - recursive: true | ||
| args: [--no-frozen-lockfile] | ||
|
|
||
| - name: Build | ||
| run : pnpm build | ||
| working-directory: package | ||
|
|
||
| - name: Publish | ||
| run : pnpm -r publish --no-git-checks --access public --provenance | ||
| working-directory: package | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
persist-credentials: falseの設定は適切ですが、workflowのpermissionsブロックでより詳細な権限制御を実装することを推奨します。特にcontents: writeの範囲を必要最小限に制限することを検討してください。