Skip to content
Open
Show file tree
Hide file tree
Changes from 19 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 95 additions & 0 deletions .github/workflows/release-please.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
name: Release Please

on:
push:
branches:
- main

permissions:
contents: write
pull-requests: write
id-token: write # Required for trusted publishing via OIDC (https://docs.npmjs.com/trusted-publishers)

jobs:
release-please:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v5

- name: Node.js LTS
uses: actions/setup-node@v5
with:
node-version: 24.x

- name: Run Release Please to update PRs and create releases
uses: googleapis/release-please-action@v4
id: release
with:
token: "${{ secrets.GITHUB_TOKEN }}"

publish-packages:
runs-on: ubuntu-24.04
needs: release-please
if: needs.release-please.outputs.releases_created == 'true'
strategy:
# Publish packages in dependency order: logger → fs → builder → server → project
# CLI is handled separately to update shrinkwrap
# Order of packages in the matrix does matter and is important!
# release-please updates the package.json dependencies with ones that do not exist yet on NPM
# Publish in the correct order is important, so that dependencies are available and resolved properly!
max-parallel: 1
matrix:
package: [logger, fs, builder, server, project]
steps:
- uses: actions/checkout@v5

- name: Node.js LTS
uses: actions/setup-node@v5
with:
node-version: 24.x

- name: Install and publish ${{ matrix.package }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Special handling for the CLI package is required, where the shrinkwrap needs to be updated/created after all dependencies have been released. Should this be done in a separate PR?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!
I think we had something related to the shrinkwrap itself, but I can't find the discussion/BLI!

I have updated the action so that it:

  • Runs the publishing of all the packages in a sequence. This ensures that during npm ci for publishing for the next package in the chain, it will have the previous package already published on NPM.
  • For the CLI, it has a special step where all the packages are available already on NPM and it's been updated accordingly.

As per my research this is the approach many monorepos are wokring. Lerna, for example

working-directory: packages/${{ matrix.package }}
run: |
echo "🚀 Publishing @ui5/${{ matrix.package }}"

# TODO: Uncomment when ready to publish
# npm ci
# npm publish --access public

publish-cli:
runs-on: ubuntu-24.04
needs: [release-please, publish-packages]
if: needs.release-please.outputs.releases_created == 'true'
steps:
- uses: actions/checkout@v5

- name: Node.js LTS
uses: actions/setup-node@v5
with:
node-version: 24.x


- name: Prepare production dependency tree
working-directory: packages/cli
run: |
echo "📦 Installing production dependencies for CLI"
npm ci --omit=dev
- name: Generate npm-shrinkwrap.json (prod only)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this guarantee that the exact same transitive dependency versions from package-lock.json are used in the packages/cli/npm-shrinkwrap.json?

Copy link
Member Author

@d3xter666 d3xter666 Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for challenging this!
Now, the answer is Yes!

I have reworked it, so that it:

  1. runs npm ci for the monorepo -> Creates a package-lock.json
  2. then isolates the cli out of the monorepo (npm shrinkwrap does not work properly for workspaces)
  3. prunes unneeded dependencies from it
  4. creates npm shrinkwrap for the isolated cli package
  5. copies the generated npm-shrinkwrap.json back to the packages/cli
  6. Deploys cli to npm

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tested this locally and compared the two lockfiles to see differences in package versions. Obviously they won't have the same content, but it helps to identify whether transitive dependencies are using the exact same version as in the existing package-lock.json. This is what I saw:

  1. The devDependencies are still included and would get installed by consumers (see https://github.com/UI5/linter/blob/01500503f8063ea9e639939ca6c515b332305580/.github/workflows/release-please.yml#L40-L54 for our current solution to this problem).
  2. I found at least one example where a transitive dependency uses a different (newer) version than defined in the package-lock.json. For https://www.npmjs.com/package/ci-info the shrinkwrap was using 4.3.1, while currently our lockfile uses 4.3.0 . See:
    "version": "4.3.0",

I'm very unhappy about the missing support from npm for such a scenario, but I don't see that we should use such a setup as it defeats the purpose of using a lockfile in the project. We will end up shipping a release with dependency version combinations that were never tested before. If there happens to be no solution to this problem, I would rather prefer to stop using a shrinkwrap, as it would at least allow consumers to upgrade the transitive packages on their end if issues occur. But not using a shrinkwrap for CLI packages is IMHO not a good idea at all and I would really like to continue using it.

run: |
echo "🔒 Creating npm-shrinkwrap.json without devDependencies"
# Create temporary directory outside workspace for shrinkwrap generation
mkdir -p /tmp/cli-shrinkwrap
cp -r packages/cli/* /tmp/cli-shrinkwrap/
cd /tmp/cli-shrinkwrap
rm -f npm-shrinkwrap.json
npm shrinkwrap
# Copy shrinkwrap back to CLI package
cp npm-shrinkwrap.json ${{ github.workspace }}/packages/cli/
echo "✅ npm-shrinkwrap.json generated"
- name: Publish @ui5/cli
working-directory: packages/cli
run: |
echo "🚀 Publishing @ui5/cli"
# TODO: Uncomment when ready to publish
# npm publish --access public
8 changes: 8 additions & 0 deletions .release-please-manifest.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"packages/logger": "4.0.2",
"packages/fs": "4.0.2",
"packages/builder": "4.0.11",
"packages/server": "4.0.7",
"packages/project": "4.0.6",
"packages/cli": "4.0.26"
}
50 changes: 25 additions & 25 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions packages/builder/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/builder",
"version": "4.0.11",
"version": "5.0.0-0",
"description": "UI5 CLI - Builder",
"author": {
"name": "SAP SE",
Expand Down Expand Up @@ -117,8 +117,8 @@
},
"dependencies": {
"@jridgewell/sourcemap-codec": "^1.5.5",
"@ui5/fs": "^4.0.2",
"@ui5/logger": "^4.0.2",
"@ui5/fs": "5.0.0-0",
"@ui5/logger": "5.0.0-0",
"cheerio": "1.0.0",
"escape-unicode": "^0.2.0",
"escope": "^4.0.0",
Expand All @@ -135,7 +135,7 @@
"devDependencies": {
"@istanbuljs/esm-loader-hook": "^0.3.0",
"@jridgewell/trace-mapping": "^0.3.31",
"@ui5/project": "^4.0.6",
"@ui5/project": "5.0.0-0",
"ava": "^6.4.1",
"chokidar-cli": "^3.0.0",
"cross-env": "^7.0.3",
Expand Down
12 changes: 6 additions & 6 deletions packages/cli/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/cli",
"version": "4.0.26",
"version": "5.0.0-0",
"description": "UI5 CLI - CLI",
"author": {
"name": "SAP SE",
Expand Down Expand Up @@ -110,11 +110,11 @@
"directory": "packages/cli"
},
"dependencies": {
"@ui5/builder": "^4.0.11",
"@ui5/fs": "^4.0.2",
"@ui5/logger": "^4.0.2",
"@ui5/project": "^4.0.6",
"@ui5/server": "^4.0.7",
"@ui5/builder": "5.0.0-0",
"@ui5/fs": "5.0.0-0",
"@ui5/logger": "5.0.0-0",
"@ui5/project": "5.0.0-0",
"@ui5/server": "5.0.0-0",
"chalk": "^5.6.2",
"data-with-position": "^0.5.0",
"import-local": "^3.2.0",
Expand Down
4 changes: 2 additions & 2 deletions packages/fs/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/fs",
"version": "4.0.2",
"version": "5.0.0-0",
"description": "UI5 CLI - File System Abstraction",
"author": {
"name": "SAP SE",
Expand Down Expand Up @@ -118,7 +118,7 @@
"directory": "packages/fs"
},
"dependencies": {
"@ui5/logger": "^4.0.2",
"@ui5/logger": "5.0.0-0",
"clone": "^2.1.2",
"escape-string-regexp": "^5.0.0",
"globby": "^15.0.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/logger/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/logger",
"version": "4.0.2",
"version": "5.0.0-0",
"description": "UI5 CLI - Internal Logger",
"author": {
"name": "SAP SE",
Expand Down
8 changes: 4 additions & 4 deletions packages/project/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/project",
"version": "4.0.6",
"version": "5.0.0-0",
"description": "UI5 CLI - Project",
"author": {
"name": "SAP SE",
Expand Down Expand Up @@ -116,8 +116,8 @@
},
"dependencies": {
"@npmcli/config": "^10.4.0",
"@ui5/fs": "^4.0.2",
"@ui5/logger": "^4.0.2",
"@ui5/fs": "5.0.0-0",
"@ui5/logger": "5.0.0-0",
"ajv": "^6.12.6",
"ajv-errors": "^1.0.1",
"chalk": "^5.6.2",
Expand All @@ -138,7 +138,7 @@
"yesno": "^0.4.0"
},
"peerDependencies": {
"@ui5/builder": "^4.0.11"
"@ui5/builder": "5.0.0-0"
},
"peerDependenciesMeta": {
"@ui5/builder": {
Expand Down
10 changes: 5 additions & 5 deletions packages/server/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@ui5/server",
"version": "4.0.7",
"version": "5.0.0-0",
"description": "UI5 CLI - Server",
"author": {
"name": "SAP SE",
Expand Down Expand Up @@ -112,9 +112,9 @@
"directory": "packages/server"
},
"dependencies": {
"@ui5/builder": "^4.0.11",
"@ui5/fs": "^4.0.2",
"@ui5/logger": "^4.0.2",
"@ui5/builder": "5.0.0-0",
"@ui5/fs": "5.0.0-0",
"@ui5/logger": "5.0.0-0",
"body-parser": "^1.20.2",
"compression": "^1.8.1",
"cors": "^2.8.5",
Expand All @@ -134,7 +134,7 @@
},
"devDependencies": {
"@istanbuljs/esm-loader-hook": "^0.3.0",
"@ui5/project": "^4.0.6",
"@ui5/project": "5.0.0-0",
"ava": "^6.4.1",
"chokidar-cli": "^3.0.0",
"cross-env": "^7.0.3",
Expand Down
Loading