Hotfix action (#8192)

* Hotfix action

* Update CONTRIBUTING.md

* Apply suggestions from code review

Co-authored-by: lrapoport-cf <[email protected]>

* format

* Update CONTRIBUTING.md

Co-authored-by: Carmen Popoviciu <[email protected]>

* Update .github/workflows/hotfix-release.yml

Co-authored-by: Carmen Popoviciu <[email protected]>

* Update CONTRIBUTING.md

* fix formatting

---------

Co-authored-by: lrapoport-cf <[email protected]>
Co-authored-by: Carmen Popoviciu <[email protected]>

Author: 3 people

.github/workflows/hotfix-release.yml

@@ -0,0 +1,65 @@
+name: Release a hotfix
+on:
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: "Which PR should be released?"
+        required: true
+      confirm:
+        description: "Confirm that the PR is up to date with the last published release, with the specific additional changes that should be released as part of this hotfix and the relevant package patch versions bumped"
+        type: boolean
+        required: true
+      prerelease:
+        description: "Publish to the hotfix tag on NPM for testing?"
+        type: boolean
+        required: true
+jobs:
+  hotfix-release:
+    name: Create Draft PR
+    if: ${{ inputs.confirm == true }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check user for team affiliation
+        uses: tspascoal/get-user-teams-membership@v2
+        id: teamAffiliation
+        with:
+          GITHUB_TOKEN: ${{ secrets.READ_ONLY_ORG_GITHUB_TOKEN }}
+          username: ${{ github.actor }}
+          team: wrangler
+
+      - name: Stop workflow if user is not a wrangler team member
+        if: ${{ steps.teamAffiliation.outputs.isTeamMember == false }}
+        run: |
+          echo "You must be on the "wrangler" team to trigger this job."
+          exit 1
+
+      - name: "Checkout PR"
+        run: gh pr checkout ${{ inputs.pr-number }}
+        env:
+          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Install Dependencies
+        uses: ./.github/actions/install-dependencies
+        with:
+          turbo-api: ${{ secrets.TURBO_API }}
+          turbo-team: ${{ secrets.TURBO_TEAM }}
+          turbo-token: ${{ secrets.TURBO_TOKEN }}
+          turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+      - name: Build all packages
+        run: pnpm run build
+        env:
+          CI_OS: ${{ runner.os }}
+
+      - name: Publish packages (prerelease)
+        if: ${{ inputs.prerelease == true }}
+        run: pnpm publish -r --tag hotfix --filter wrangler --filter miniflare --filter create-cloudflare --dry-run
+
+      - name: Publish packages
+        if: ${{ inputs.prerelease == false }}
+        run: pnpm publish -r --filter wrangler --filter miniflare --filter create-cloudflare --dry-run

.github/workflows/run-ci-for-external-forks.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Stop workflow if user is not a team member
         if: ${{ steps.teamAffiliation.outputs.isTeamMember == false }}
         run: |
-          echo "You have must be on the "wrangler" team to trigger this job."
+          echo "You must be on the "wrangler" team to trigger this job."
           exit 1
 
       - name: "Checkout PR"

CONTRIBUTING.md

@@ -431,3 +431,21 @@ When contributing to Wrangler, please refer to the [`STYLEGUIDE.md file`](STYLEG
 ## Releases
 
 We generally cut Wrangler releases on Tuesday & Thursday each week. If you need a release cut outside of the regular cadence, please reach out to the [@cloudflare/wrangler-admins](https://github.com/orgs/cloudflare/teams/wrangler-admins) team.
+
+### Hotfix releases
+
+Only members of `@cloudflare/wrangler` can trigger a hotfix release. A hotfix release should be treated as a solution of last resort—before use, please first check whether the fix can be applied and released using the regular Version Packages release flow.
+
+If a hotfix release of Wrangler, Miniflare, or C3 is required, you should:
+
+- Prepare a hotfix release PR:
+
+  - Checkout the previous release of `workers-sdk`
+  - Apply the changes that should be in the hotfix
+  - Increment the patch version of the packages that should be released as part of the hotfix
+
+- Get approvals for that PR, and make sure CI checks are passing
+- Manually trigger a hotfix release from that PR using the ["Release a hotfix"](https://github.com/cloudflare/workers-sdk/actions/workflows/hotfix-release.yml) GitHub action.
+  - Optionally, you can first publish it to the `hotfix` tag on NPM in order to verify the release.
+- **[CRUCIAL]** Once the hotfix release is out and verified, merge the fixes into main before the next regular release of `workers-sdk`.
+- Make sure that the version number of the next changesets-based release of Wrangler/Miniflare/C3 is greater than the version used for the hotfix by adding a dummy `minor` changeset entry for each of the packages that had a hotfix published.