Merge pull request #48 from aspiers/update-release-workflows

Author: aspiers

.changeset/config.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://unpkg.com/@changesets/[email protected]/schema.json",
+  "changelog": [
+    "@changesets/changelog-github",
+    { "repo": "hypercerts-org/hypercerts-lexicon" }
+  ],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/create-prerelease-lexicon.yml

@@ -0,0 +1,29 @@
+name: PR Check
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  changeset-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+      - run: npm ci
+      - name: Check for changeset
+        run: |
+          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q "^lexicons/\|^types/\|^package.json"; then
+            if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q "^\.changeset/.*\.md$"; then
+              echo "Changeset found"
+            else
+              echo "::warning::No changeset found. Run 'npm run changeset' if this PR includes user-facing changes."
+            fi
+          else
+            echo "No package changes detected"
+          fi

.github/workflows/create-release-lexicon.yml

@@ -0,0 +1,83 @@
+name: Release Beta
+
+on:
+  workflow_dispatch:
+  # SDK uses automatic triggers on develop branch, but for now
+  # we'll manually trigger.
+  # push:
+  #   branches: [main]
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release-beta:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Check RELEASE_PAT secret exists
+        run: |
+          if [ -z "${{ secrets.RELEASE_PAT }}" ]; then
+            echo "Error: RELEASE_PAT secret is required but not set"
+            echo "This workflow requires a Personal Access Token to bypass branch protection rules"
+            exit 1
+          fi
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # Use PAT to bypass branch protection rules when committing and pushing
+          token: ${{ secrets.RELEASE_PAT }}
+      # Branch check is necessary for manual triggers (workflow_dispatch) to ensure
+      # we only push version changes to main. If using automatic push triggers,
+      # the trigger itself would enforce the branch, but manual triggers can run
+      # from any branch.
+      - name: Check branch is main
+        run: |
+          if [ "${{ github.ref }}" != "refs/heads/main" ]; then
+            echo "Error: This workflow must be run on the main branch"
+            exit 1
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run check
+
+      - name: Enter prerelease mode (if not already)
+        run: |
+          if [ ! -f .changeset/pre.json ]; then
+            npx changeset pre enter beta
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add .changeset/pre.json
+            git commit -m "chore: enter beta prerelease mode"
+          fi
+
+      - name: Version packages
+        run: npm run version-packages
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create .npmrc
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
+          echo "@hypercerts-org:registry=https://registry.npmjs.org/" >> .npmrc
+
+      - name: Publish beta packages
+        # Use npm run release to match regular releases - it runs check before publishing
+        # to ensure validation after versioning (package.json/changelog changes)
+        run: npm run release
+        env:
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Commit and push version changes
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --staged --quiet || git commit -m "chore: version packages (beta)"
+          git push

.github/workflows/dryrun-release-ci-lexicon.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run check
+
+      - name: Create .npmrc
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
+          echo "@hypercerts-org:registry=https://registry.npmjs.org/" >> .npmrc
+
+      - name: Create Release Pull Request or Publish
+        id: changesets
+        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
+        with:
+          publish: npm run release
+          version: npm run version-packages
+          title: "chore: release packages"
+          commit: "chore: release packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Log published packages
+        if: steps.changesets.outputs.published == 'true'
+        run: echo "Published - ${{ steps.changesets.outputs.publishedPackages }}"