Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 25 additions & 45 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -1,67 +1,47 @@
name: Release Full
# This action will publish the package to npm and create a GitHub release.
name: Release

on:
workflow_dispatch:
inputs:
tag:
type: choice
description: 'Release Npm Tag'
required: true
default: 'nightly'
options:
- alpha
- beta
- canary
- latest
- nightly
- rc
# Run `npm run bump` to bump the version and create a git tag.
push:
tags:
- 'v*'

dry_run:
type: boolean
description: 'DryRun release'
required: true
default: false
workflow_dispatch:

permissions:
contents: write
# To publish packages with provenance
id-token: write

jobs:
release:
name: Release
environment: npm
publish:
runs-on: ubuntu-latest

environment: npm
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install Pnpm
run: npm i -g corepack@latest --force && corepack enable
uses: actions/checkout@v6

- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
uses: actions/setup-node@v6
with:
node-version: 24.14.1
cache: 'pnpm'
node-version: 24

# Update npm to the latest version to enable OIDC
- name: Update npm
- name: Setup Package Managers
run: |
npm install -g npm@latest
npm --version
npm install -g corepack@latest --force
corepack enable

- name: Install Dependencies
run: pnpm install

- name: Run Test
run: pnpm run test

- name: Dry run release to npm
if: inputs.dry_run
run: node scripts/release.js --dry-run --tag ${{ inputs.tag }}
- name: Publish
uses: JS-DevTools/npm-publish@v4
with:
token: empty
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Replace placeholder npm token before publishing

The publish step passes a literal placeholder token (empty) into JS-DevTools/npm-publish, so npm publication will run without valid credentials and fail when attempting to publish this scoped package. This makes the release workflow non-functional in production unless a real auth mechanism is wired in for this input.

Useful? React with 👍 / 👎.


- name: Release to npm
if: ${{ !inputs.dry_run }}
run: node scripts/release.js --tag ${{ inputs.tag }}
- name: Create GitHub Release
uses: ncipollo/release-action@v1
with:
# TODO: remove beta tag before release stable
tag: beta
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use triggering tag for GitHub release

The release job is triggered by pushed tags (v*), but this step hardcodes tag: beta, so every run creates/updates a release for beta instead of the actual tag that triggered the workflow (for example v1.6.3). That disconnects the GitHub release from the published package version and will cause repeated collisions on the same beta tag across releases.

Useful? React with 👍 / 👎.

generateReleaseNotes: 'true'
2 changes: 0 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,6 @@
"@rspack/core": "2.0.0-rc.0",
"@rstest/core": "^0.9.6",
"@types/node": "^24.12.2",
"cac": "^7.0.0",
"execa": "9.6.1",
"prettier": "^3.8.1",
"react-refresh": "^0.18.0",
"simple-git-hooks": "^2.13.1",
Expand Down
180 changes: 0 additions & 180 deletions pnpm-lock.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading