Alert users about incomplete release PRs

Currently we use the `is-release` action to determine whether a commit
merged to `main` is a release commit, and if so, we run the release
workflow. A commit becomes a release commit when:

- the root package version is bumped
- the subject of the merged commit matches "Release X.Y.Z",
  "Release/X.Y.Z", or something similar

However, oftentimes engineers will create a PR and bump some packages'
versions but forget to bump the root version. When this PR is merged,
the release workflow won't run — but by then it is too late, and the
engineer is forced to revert the PR and recreate it correctly. This is
painful.

To prevent this, this commit replaces the `is-action` with a custom
workflow that looks at three things:

- whether the root package is bumped
- whether the title of the release is well-formed
- whether any of the packages in the monorepo have been bumped

As before, this workflow runs when a release commit is merged, and the
result is used to determine whether to run the release workflow. But
now, this workflow also runs on each pull request and acts as a gate:

- If the engineer bumps the root package but does not fulfill
  the other two requirements, then the workflow will fail and the PR
  will not be mergeable.
- If the engineer does not bump the root package but fulfills one or
  both of the other two requirements, then the workflow will not fail,
  but it will show a warning so that the engineer can double-check.
- (Pull requests that do not fulfill any of the three requirements will
  be ignored.)

Author: mcmire

.github/workflows/main.yml

@@ -40,38 +40,6 @@ jobs:
     needs: check-workflows
     uses: ./.github/workflows/lint-build-test.yml
 
-  is-release:
-    name: Determine whether this is a release merge commit
-    needs: lint-build-test
-    if: github.event_name == 'push'
-    runs-on: ubuntu-latest
-    outputs:
-      IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
-    steps:
-      - id: is-release
-        uses: MetaMask/action-is-release@dc4672b05e3b1d464cdaf783579b04a4e43f8b02
-        with:
-          commit-starts-with: 'Release [version],Release v[version],Release/[version],Release/v[version],Release `[version]`'
-
-  publish-release:
-    name: Publish release
-    needs: is-release
-    if: needs.is-release.outputs.IS_RELEASE == 'true'
-    permissions:
-      contents: write
-    uses: ./.github/workflows/publish-release.yml
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
-  create-update-issues:
-    name: Create update issues
-    needs: [is-release, publish-release]
-    if: needs.is-release.outputs.IS_RELEASE == 'true'
-    uses: ./.github/workflows/create-update-issues.yaml
-    secrets:
-      CORE_CREATE_UPDATE_ISSUES_TOKEN: ${{ secrets.CORE_CREATE_UPDATE_ISSUES_TOKEN }}
-
   all-jobs-complete:
     name: All jobs complete
     runs-on: ubuntu-latest
@@ -97,3 +65,30 @@ jobs:
           if [[ $passed != "true" ]]; then
             exit 1
           fi
+
+  validate-release:
+    name: Identify and validate release PR/commit
+    needs:
+      - analyse-code
+      - lint-build-test
+    uses: ./.github/workflows/validate-release.yml
+    with:
+      valid-release-title-patterns: 'Release [version],Release v[version],Release/[version],Release/v[version],Release \`[version]\`'
+
+  publish-release:
+    name: Publish release
+    needs: validate-release
+    if: "github.event_name == 'push' && needs.validate-release.outputs.RELEASE_VALIDATION_RESULT == 'valid-release'"
+    permissions:
+      contents: write
+    uses: ./.github/workflows/publish-release.yml
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  create-update-issues:
+    name: Create update issues
+    needs: publish-release
+    uses: ./.github/workflows/create-update-issues.yaml
+    secrets:
+      CORE_CREATE_UPDATE_ISSUES_TOKEN: ${{ secrets.CORE_CREATE_UPDATE_ISSUES_TOKEN }}

.github/workflows/validate-release.yml

@@ -0,0 +1,43 @@
+name: Validate Release
+
+on:
+  workflow_call:
+    inputs:
+      valid-release-title-patterns:
+        type: string
+        description: "Validate that the name of the release commit or PR starts with a string in this comma-separated list. Use '[version]' to refer to the current release version."
+        required: false
+    outputs:
+      RELEASE_VALIDATION_RESULT: ${{ jobs.validate-release.outputs.RELEASE_VALIDATION_RESULT }}
+
+jobs:
+  validate-release:
+    runs-on: ubuntu-latest
+    outputs:
+      RELEASE_VALIDATION_RESULT: ${{ steps.validate-release.outputs.RELEASE_VALIDATION_RESULT }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          # We need the latest commit and the one before it so we can compare them
+          fetch-depth: 2
+      - name: Validate release
+        id: validate-release
+        run: |
+          case "$GITHUB_EVENT_NAME" in
+            push)
+              yarn ts-node scripts/validate-release.ts "$GITHUB_EVENT_NAME" "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" "$GITHUB_EVENT_HEAD_COMMIT_MESSAGE" "$VALID_RELEASE_TITLE_PATTERNS"
+              ;;
+            pull_request)
+              yarn ts-node scripts/validate-release.ts "$GITHUB_EVENT_NAME" "$GITHUB_BASE_REF" "$GITHUB_SHA" "$GITHUB_EVENT_PULL_REQUEST_TITLE" "$VALID_RELEASE_TITLE_PATTERNS"
+              ;;
+            *)
+              echo "Unknown GitHub event name: $GITHUB_EVENT_NAME"
+              exit 1
+          esac
+        shell: bash
+        env:
+          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
+          GITHUB_EVENT_HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}
+          VALID_RELEASE_TITLE_PATTERNS: ${{ inputs.valid-release-title-patterns }}

package.json

@@ -50,6 +50,7 @@
     "[email protected]": "^7.5.10"
   },
   "devDependencies": {
+    "@actions/core": "^1.11.1",
     "@babel/core": "^7.23.5",
     "@babel/plugin-transform-modules-commonjs": "^7.23.3",
     "@babel/preset-typescript": "^7.23.3",