Skip to content

build(release): migrate to Craft #1232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
betegon merged 25 commits into from
Jan 12, 2026
Merged

build(release): migrate to Craft #1232

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
f5754ad
chore: remove changesets dependencies and workflows
betegon Jan 7, 2026
41587ee
feat: add Craft release configuration
betegon Jan 7, 2026
e850d38
ci: update GitHub Actions for Craft releases
betegon Jan 7, 2026
f518553
docs: update contributor docs for Craft workflow
betegon Jan 7, 2026
21675af
Merge branch 'main' into feat/migrate-to-craft
betegon Jan 7, 2026
ce4339b
remove spacing
betegon Jan 7, 2026
22d75f7
remove spacing
betegon Jan 7, 2026
42d2991
remove default config
betegon Jan 7, 2026
54ecc54
fix: use craft publish via getsentry/publish repo
betegon Jan 7, 2026
ed2a94f
docs: add release flow documentation
betegon Jan 8, 2026
3c9e98e
change action name
betegon Jan 8, 2026
95d2a0e
Merge branch 'main' into feat/migrate-to-craft
betegon Jan 9, 2026
eef79fc
feat: add Electron app build and validation workflow
betegon Jan 9, 2026
ca733ce
docs
betegon Jan 9, 2026
2c810ce
improve docs
betegon Jan 9, 2026
7f00ff0
mention publish
betegon Jan 9, 2026
e7e989b
more docs
betegon Jan 9, 2026
39dc3f5
remove redundant code and simplify update version
betegon Jan 9, 2026
f5f2164
use sentry release bot
betegon Jan 12, 2026
467afc1
remove guide
betegon Jan 12, 2026
d489298
remove changeset stuff
betegon Jan 12, 2026
b95ee97
added regex to match cli binaries and electron files
betegon Jan 12, 2026
45ace77
update regex in .craft.yml to include latest tags and specific file t…
betegon Jan 12, 2026
c0e997e
minor things
BYK Jan 12, 2026
3467ee2
Merge branch 'main' into feat/migrate-to-craft
betegon Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions .craft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Craft Release Configuration
# https://getsentry.github.io/craft/configuration/

minVersion: "2.16.0"

github:
owner: getsentry
repo: spotlight

# Use automatic versioning based on conventional commits
versioning:
policy: auto

# Automatically generate changelog from conventional commits
changelog:
filePath: packages/spotlight/CHANGELOG.md
policy: auto
scopeGrouping: true

# Pre-release script to bump version in package.json
preReleaseCommand: bash scripts/bump-version.sh

# Artifacts are uploaded by GitHub Actions
artifactProvider:
name: github

# Build status from GitHub Actions
statusProvider:
name: github
config:
contexts:
- "Build"
Copy link

@cursor cursor bot Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Status context mismatch may prevent Craft release

Medium Severity

The statusProvider.contexts configuration specifies "Build" as the required status context. However, GitHub Actions status checks are typically named using the format {workflow-name} / {job-name}. Since the workflow is named "Build & Test" and the job is named "Build", the actual status check context will be "Build & Test / Build". If Craft requires an exact match, it won't detect when the build completes, potentially blocking releases. The context should likely be "Build & Test / Build" or use a pattern that matches the full status check name.

Fix in Cursor Fix in Web


# Required artifacts before publishing
requireNames:
- /^built-packages$/
- /^spotlight-binaries$/

# Targets - executed by getsentry/publish repo
targets:
# Publish @spotlightjs/spotlight to NPM registry
- name: npm
id: spotlight
path: packages/spotlight

# Create GitHub release with standalone binaries
- name: github
tagPrefix: "@spotlightjs/spotlight@"
4 changes: 3 additions & 1 deletion .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@ name: Build & Test

on:
push:
branches: [main]
branches:
- main
- "release/**"
pull_request:

concurrency:
Expand Down
15 changes: 15 additions & 0 deletions .github/workflows/changelog-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Changelog Preview workflow
# Shows how PRs will appear in the changelog
# https://getsentry.github.io/craft/

name: Changelog Preview
on:
pull_request:
types: [opened, synchronize, reopened, edited, labeled, unlabeled]

jobs:
changelog-preview:
name: Preview Changelog
uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2
secrets: inherit
Comment on lines +12 to +14

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

To fix the problem, add an explicit permissions block that restricts the default GITHUB_TOKEN access for this workflow. Because this workflow is only orchestrating a reusable workflow and does not itself perform any direct repository mutations, a safe and conservative default is contents: read. This adheres to the principle of least privilege while still allowing typical read operations (like fetching code) if needed by the reusable workflow.

The best way to fix this without changing existing functionality is:

  • Add a permissions block at the root level of .github/workflows/changelog-preview.yml, alongside name and on, so that it applies to all jobs in the workflow (including the changelog-preview job).
  • Set contents: read as the minimal permission. If the reusable workflow needs additional scopes (for example, pull-requests: write), those should be added there, but we will not assume extra needs beyond contents: read since we cannot see the implementation of the reusable workflow and we must avoid altering behavior more than necessary.

Concretely:

  • In .github/workflows/changelog-preview.yml, after the name: Changelog Preview line, insert:
permissions:
  contents: read

No imports or additional methods are required, as this is a YAML configuration change only.

Suggested changeset 1
.github/workflows/changelog-preview.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
--- a/.github/workflows/changelog-preview.yml
+++ b/.github/workflows/changelog-preview.yml
@@ -3,6 +3,8 @@
 # https://getsentry.github.io/craft/
 
 name: Changelog Preview
+permissions:
+  contents: read
 on:
   pull_request:
     types: [opened, synchronize, reopened, edited, labeled, unlabeled]
EOF
@@ -3,6 +3,8 @@
# https://getsentry.github.io/craft/

name: Changelog Preview
permissions:
contents: read
on:
pull_request:
types: [opened, synchronize, reopened, edited, labeled, unlabeled]
Copilot is powered by AI and may make mistakes. Always verify output.

43 changes: 0 additions & 43 deletions .github/workflows/prepare-publish.yml
View file
Open in desktop

This file was deleted.

Loading
Loading