Skip to content

Release

Release #19

Workflow file for this run

name: Release
on:
workflow_dispatch:
concurrency: ${{ github.workflow }}-${{ github.ref }}
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
# Required for npm Trusted Publishers via GitHub OIDC
# See: https://docs.npmjs.com/trusted-publishers
id-token: write
steps:
- name: Generate Release Bot App Token
id: generate-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}
- uses: actions/checkout@v6
with:
# Persist releasebot app credentials to ensure that the push
# below can bypass branch protection rules
token: ${{ steps.generate-token.outputs.token }}
persist-credentials: true
fetch-depth: 0
# Branch validation: Only allow develop (beta) or main (stable)
- name: Validate branch
run: |
if [ "${{ github.ref }}" == "refs/heads/develop" ]; then
echo "RELEASE_TYPE=beta" >> $GITHUB_ENV
echo "Detected beta release from develop branch"
elif [ "${{ github.ref }}" == "refs/heads/main" ]; then
echo "RELEASE_TYPE=stable" >> $GITHUB_ENV
echo "Detected stable release from main branch"
else
echo "Error: This workflow can only be run from 'develop' (beta) or 'main' (stable) branches"
exit 1
fi
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: "pnpm"
# registry-url is required for npm Trusted Publishers
registry-url: "https://registry.npmjs.org"
# Upgrade to npm >=11.5.1 for Trusted Publishers support
# (pnpm uses npm under the hood for publishing)
- run: npm install -g npm@latest
- run: pnpm install
# Work around Turbo failing to allow cross-package task
# dependencies - we need sdk-core built before sdk-react
# can even typecheck successfully
- run: pnpm --filter @hypercerts-org/sdk-core build
# Run checks early to fail fast before any versioning/git operations.
# Note: checks run again in `pnpm release` - this is intentional to also
# guard local releases and catch any issues after version bumps.
#
# FIXME: We can't run pnpm check because it currently hangs
# forever for unknown reasons.
- run: pnpm build
- run: pnpm format:check
- run: pnpm lint
- run: pnpm typecheck
- run: pnpm test
# Stable release: Verify prerelease mode has been exited
# The exit intent should already be set on develop before merging to main
- name: Verify prerelease mode exit
if: env.RELEASE_TYPE == 'stable'
run: |
if [ -f .changeset/pre.json ]; then
# Check if prerelease mode has been exited (exit intent set)
if ! grep -q '"exit": true' .changeset/pre.json 2>/dev/null; then
echo "Error: Prerelease mode must be exited before merging to main."
echo "Run 'pnpm changeset pre exit' on the develop branch and commit the change."
exit 1
fi
echo "Prerelease mode exit intent confirmed - changeset version will handle the exit"
else
echo "No prerelease mode detected (pre.json not present)"
fi
# Beta-specific: Enter prerelease mode (if not already)
- name: Enter prerelease mode (if not already)
if: env.RELEASE_TYPE == 'beta'
run: |
if [ ! -f .changeset/pre.json ]; then
pnpm changeset pre enter beta
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add .changeset/pre.json
git commit -m "chore: enter beta prerelease mode"
git push
fi
# Beta-specific: Version packages manually
- name: Version packages
if: env.RELEASE_TYPE == 'beta'
# GITHUB_TOKEN is required for @changesets/changelog-github to fetch PR/commit
# information from GitHub API when generating changelog entries
run: pnpm version-packages
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Beta-specific: Commit and push version changes (before publishing)
- name: Commit and push version changes
if: env.RELEASE_TYPE == 'beta'
run: |
VERSIONS=""
for pkg in packages/*/package.json; do
NAME=$(node -p "require('./$pkg').name")
VERSION=$(node -p "require('./$pkg').version")
VERSIONS="${VERSIONS}- ${NAME}: ${VERSION}\n"
done
echo "Versioning packages:"
echo -e "$VERSIONS"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add -A
git diff --staged --quiet || git commit -m "chore: version packages (beta)" -m "$(echo -e "$VERSIONS")"
git push
# No .npmrc creation needed - npm Trusted Publishers uses GitHub OIDC tokens
# automatically via the id-token: write permission and registry-url configuration
# Stable release: Use changesets/action which handles versioning and publishing
- name: Create Release Pull Request or Publish
if: env.RELEASE_TYPE == 'stable'
id: changesets
uses: changesets/action@v1
with:
publish: pnpm release
version: pnpm version-packages
title: "chore: release packages"
commit: "chore: release packages"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_CONFIG_PROVENANCE: true
# Beta-specific: Publish beta packages using changeset publish
- name: Publish beta packages
if: env.RELEASE_TYPE == 'beta'
# changeset publish will automatically use the beta tag when in
# prerelease mode and will create git tags for the release
run: pnpm release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_CONFIG_PROVENANCE: true
# Push git tags created by changeset publish
- name: Push git tags
if: env.RELEASE_TYPE == 'beta'
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git push origin --tags
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Log published packages
- name: Log published packages
if: |
(env.RELEASE_TYPE == 'stable' && steps.changesets.outputs.published == 'true') ||
env.RELEASE_TYPE == 'beta'
run: |
if [ "${{ env.RELEASE_TYPE }}" == "stable" ]; then
echo "Published - ${{ steps.changesets.outputs.publishedPackages }}"
else
echo "Published beta release:"
for pkg in packages/*/package.json; do
NAME=$(node -p "require('./$pkg').name")
VERSION=$(node -p "require('./$pkg').version")
echo " - ${NAME}: ${VERSION}"
done
fi