Add Changesets-based release tracking without forking changesets/action#54
Conversation
Co-authored-by: TylerJDev <26746305+TylerJDev@users.noreply.github.com>
Co-authored-by: TylerJDev <26746305+TylerJDev@users.noreply.github.com>
TylerJDev
left a comment
TylerJDev
left a comment
There was a problem hiding this comment.
Most of the changes are within scripts/prepare-release.mjs, as we try to handle as much as we can through @changesets.
An alternative to this approach is applying a patch changeset to each dependency bump, which would allow us to mainly rely on @changesets.
| import {fileURLToPath} from 'node:url' | ||
|
|
||
| export const AUTO_CHANGESET_FILENAME = 'auto-release.md' | ||
| export const DEFAULT_DEPENDENCY_RELEASE_AGE_DAYS = 30 |
There was a problem hiding this comment.
This is the minimum amount of days before the release PR is generated. If there hasn't been a release in the past 30 days, one will be generated.
| { | ||
| "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json", | ||
| "changelog": ["@changesets/changelog-github", {"repo": "github/remote-input-element"}], | ||
| "commit": false, | ||
| "fixed": [], | ||
| "linked": [], | ||
| "access": "public", | ||
| "baseBranch": "main", | ||
| "updateInternalDependencies": "patch", | ||
| "ignore": [] | ||
| } |
There was a problem hiding this comment.
Mainly copies our config from primer/react (https://github.com/primer/react/blob/main/.changeset/config.json)
| @@ -1,27 +0,0 @@ | |||
| name: Publish | |||
There was a problem hiding this comment.
We can rely on the release.yml workflow now instead of manually publishing.
| export function tagExists(tag, cwd) { | ||
| try { | ||
| git(['rev-parse', '--verify', '--quiet', `refs/tags/${tag}`], cwd) | ||
| return true | ||
| } catch { | ||
| return false | ||
| } | ||
| } | ||
|
|
||
| export function getTagDate(tag, cwd) { | ||
| return new Date(Number(git(['log', '-1', '--format=%ct', tag], cwd)) * 1000) | ||
| } |
There was a problem hiding this comment.
Checks the most recent release (e.g. 0.4.0) in order to confirm if that release was made at least 30 days ago.
| export function isSecurityUpdate(pullRequest) { | ||
| const text = `${pullRequest.title ?? ''}\n${pullRequest.body ?? ''}` | ||
| const labels = (pullRequest.labels ?? []).map(label => (typeof label === 'string' ? label : label.name ?? '')) | ||
| return ( | ||
| labels.some(label => /security|vulnerability/i.test(label)) || | ||
| /<h[1-6]>\s*Security\s*<\/h[1-6]>/i.test(text) || | ||
| /^\s{0,3}#{1,6}\s+Security\b/im.test(text) || | ||
| /\b(?:CVE-\d{4}-\d+|GHSA-[a-z0-9-]+)\b/i.test(text) | ||
| ) | ||
| } |
There was a problem hiding this comment.
This tries to determine if the contribution is a security update or not - if it is, it'll go ahead and skip the 30 day policy and create a release PR automatically.
Note
Most of the changed lines are in
package-lock.json, due to adding@changesets/changelog-githuband@changesets/cliand their dependencies.Dependabot PRs usually merge without changesets. This means that our usual flow with
Changesetsdoes not work. Due to this, we can create our own workflow that will batch all dependency updates in the current release, under onepatchbump.The flow in this PR uses
changesets/action@, plus a script that creates automatic patch changesets for unreleased commits when contributions (such as Dependabot) do not have a changeset.Example: TylerJDev#5
Workflow changes
.github/workflows/release.yml, triggered by pushes tomainand manually throughworkflow_dispatch.npm run prepare-release.changesets/actionaction to open or update a Release tracking pull request or publish the package.