add continuous release workflow #65
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| @@ -0,0 +1,28 @@ | |||
| name: Publish Any Commit | |||
There was a problem hiding this comment.
There appears to be a typo in the filename: continuous-releast.yml should be continuous-release.yml. This could potentially cause issues if the workflow is referenced by name in other parts of the codebase or documentation. Consider correcting the spelling before merging.
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
@proofkit/better-auth
@proofkit/cli
create-proofkit
@proofkit/fmdapi
@proofkit/typegen
@proofkit/webviewer
commit: |
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdds a GitHub Actions workflow "Publish Any Commit" that runs on push and pull_request, checks out the repo, enables corepack, sets up Node.js 22 with pnpm caching, runs Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Dev (push/pr)
participant GH as GitHub Actions
participant Runner as ubuntu-latest
Dev->>GH: push / pull_request
GH->>Runner: start job "build"
Runner->>Runner: actions/checkout@v4
Runner->>Runner: corepack enable
Runner->>Runner: actions/setup-node@v4 (Node.js v22, pnpm cache)
Runner->>Runner: pnpm install
Runner->>Runner: pnpm build
Runner->>Runner: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpm
Runner->>GH: job completes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: .coderabbit.yaml 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (6)
.github/workflows/continuous-releast.yml (6)
1-1: Typo in workflow filename ("continuous-releast.yml").Recommend renaming the file to "continuous-release.yml" (or "continuous-release.yaml") to avoid confusion and improve discoverability.
2-2: Confirm intent to publish on every push and PR.Running publish logic on both push and pull_request can spam preview publishes and comments on non-PR commits. If the goal is PR preview publishes (as pkg-pr-new typically does), restrict to pull_request (and optionally workflow_dispatch). If you truly want it on push, consider gating publish steps by event.
Option A (PR-only triggers):
-on: [push, pull_request] +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + workflow_dispatch:Option B (gate publish steps to PR events; see a concrete diff for lines 24–28 in a later comment).
12-17: Enable Corepack after setting up Node; tighten caching.Small ordering nit: enable Corepack after actions/setup-node to match the configured Node version. Also consider pinning cache by pnpm-lock.yaml for more reliable cache hits.
Apply this diff:
- - run: corepack enable - uses: actions/setup-node@v4 with: node-version: 22 cache: "pnpm" + cache-dependency-path: pnpm-lock.yaml + + - run: corepack enable
18-23: LGTM: Install and build are straightforward.Assuming a workspace with a proper build script, this is fine. Optionally add “CI=true” to fail on warnings if desired.
- - name: Build - run: pnpm build + - name: Build + run: CI=true pnpm build
1-6: Add concurrency to auto-cancel superseded runs on the same ref/PR.This keeps only the latest run active and saves minutes.
Apply this diff near the top (after “on” and before “jobs”):
name: Publish Any Commit on: [push, pull_request] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: build: runs-on: ubuntu-latest
24-28: Reduce duplication by publishing via a matrix.Nice-to-have: make the five publish steps a matrix to keep DRY and easier to add/remove packages.
Here’s an example replacement for the publish steps:
strategy: matrix: pkg: - path: ./packages/cli flags: --bin - path: ./packages/typegen flags: --bin - path: ./packages/fmdapi flags: "" - path: ./packages/webviewer flags: "" - path: ./packages/better-auth flags: "" steps: # ...checkout/setup/install/build... - if: ${{ github.event_name == 'pull_request' }} name: Publish ${{ matrix.pkg.path }} run: pnpm dlx pkg-pr-new publish '${{ matrix.pkg.path }}' ${{ matrix.pkg.flags }} --packageManager=pnpm
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/continuous-releast.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: build
🔇 Additional comments (1)
.github/workflows/continuous-releast.yml (1)
8-11: LGTM: Checkout step is standard.actions/checkout@v4 with default settings is appropriate here.
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Set explicit GITHUB_TOKEN permissions required by pkg-pr-new.
pkg-pr-new typically needs to comment on PRs. The default GITHUB_TOKEN may be read-only; set minimal write permissions for pull-requests.
Apply this diff at the top-level (after “on”) to grant the least privileges needed:
name: Publish Any Commit
on: [push, pull_request]
+permissions:
+ contents: read
+ pull-requests: write
+
jobs:
build:
runs-on: ubuntu-latest📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| name: Publish Any Commit | |
| on: [push, pull_request] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| # …other steps… |
🤖 Prompt for AI Agents
In .github/workflows/continuous-releast.yml around lines 3-6, the workflow
doesn't set explicit GITHUB_TOKEN permissions required by pkg-pr-new; add a
top-level permissions section (immediately after the existing "on" key) that
grants the minimal write scope needed for commenting on PRs by setting
pull-requests: write (and keep other scopes read-only, e.g., contents: read if
your jobs need repo contents). Ensure this permissions block is top-level in the
workflow file so the GITHUB_TOKEN has the least privilege required for
pkg-pr-new to comment on pull requests.
| - run: pnpm dlx pkg-pr-new publish './packages/cli' --bin --packageManager=pnpm | ||
| - run: pnpm dlx pkg-pr-new publish './packages/typegen' --bin --packageManager=pnpm | ||
| - run: pnpm dlx pkg-pr-new publish './packages/fmdapi' --packageManager=pnpm | ||
| - run: pnpm dlx pkg-pr-new publish './packages/webviewer' --packageManager=pnpm | ||
| - run: pnpm dlx pkg-pr-new publish './packages/better-auth' --packageManager=pnpm |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Gate preview publishes to PR events (avoid publishing on pushes).
If you keep on: [push, pull_request], at least restrict pkg-pr-new to PRs to prevent unnecessary runs and comments on non-PR commits.
Apply this diff:
- - run: pnpm dlx pkg-pr-new publish './packages/cli' --bin --packageManager=pnpm
- - run: pnpm dlx pkg-pr-new publish './packages/typegen' --bin --packageManager=pnpm
- - run: pnpm dlx pkg-pr-new publish './packages/fmdapi' --packageManager=pnpm
- - run: pnpm dlx pkg-pr-new publish './packages/webviewer' --packageManager=pnpm
- - run: pnpm dlx pkg-pr-new publish './packages/better-auth' --packageManager=pnpm
+ - if: ${{ github.event_name == 'pull_request' }}
+ run: pnpm dlx pkg-pr-new publish './packages/cli' --bin --packageManager=pnpm
+ - if: ${{ github.event_name == 'pull_request' }}
+ run: pnpm dlx pkg-pr-new publish './packages/typegen' --bin --packageManager=pnpm
+ - if: ${{ github.event_name == 'pull_request' }}
+ run: pnpm dlx pkg-pr-new publish './packages/fmdapi' --packageManager=pnpm
+ - if: ${{ github.event_name == 'pull_request' }}
+ run: pnpm dlx pkg-pr-new publish './packages/webviewer' --packageManager=pnpm
+ - if: ${{ github.event_name == 'pull_request' }}
+ run: pnpm dlx pkg-pr-new publish './packages/better-auth' --packageManager=pnpm📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - run: pnpm dlx pkg-pr-new publish './packages/cli' --bin --packageManager=pnpm | |
| - run: pnpm dlx pkg-pr-new publish './packages/typegen' --bin --packageManager=pnpm | |
| - run: pnpm dlx pkg-pr-new publish './packages/fmdapi' --packageManager=pnpm | |
| - run: pnpm dlx pkg-pr-new publish './packages/webviewer' --packageManager=pnpm | |
| - run: pnpm dlx pkg-pr-new publish './packages/better-auth' --packageManager=pnpm | |
| - if: ${{ github.event_name == 'pull_request' }} | |
| run: pnpm dlx pkg-pr-new publish './packages/cli' --bin --packageManager=pnpm | |
| - if: ${{ github.event_name == 'pull_request' }} | |
| run: pnpm dlx pkg-pr-new publish './packages/typegen' --bin --packageManager=pnpm | |
| - if: ${{ github.event_name == 'pull_request' }} | |
| run: pnpm dlx pkg-pr-new publish './packages/fmdapi' --packageManager=pnpm | |
| - if: ${{ github.event_name == 'pull_request' }} | |
| run: pnpm dlx pkg-pr-new publish './packages/webviewer' --packageManager=pnpm | |
| - if: ${{ github.event_name == 'pull_request' }} | |
| run: pnpm dlx pkg-pr-new publish './packages/better-auth' --packageManager=pnpm |
🤖 Prompt for AI Agents
In .github/workflows/continuous-releast.yml around lines 24 to 28, the
pkg-pr-new publish steps run on both push and pull_request events causing
unnecessary preview publishes and PR comments on non-PR commits; restrict those
steps to only run for PR events by adding a conditional to each publish job or
step such as an if: github.event_name == 'pull_request' (or equivalent
startsWith check) so the pnpm dlx pkg-pr-new commands execute only during
pull_request events, preventing publishes on pushes.
| @@ -0,0 +1,24 @@ | |||
| name: Publish Any Commit | |||
There was a problem hiding this comment.
Both workflows currently share the same name "Publish Any Commit", which may create ambiguity in the GitHub Actions UI when viewing workflow runs. Consider renaming this workflow to something more descriptive like Publish Binary Packages to clearly differentiate its purpose from the other workflow that handles non-binary packages. This will make it easier to identify and monitor specific workflow runs at a glance.
| name: Publish Any Commit | |
| name: Publish Binary Packages |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (13)
.github/workflows/continuous-release.yml (6)
1-1: Give this workflow a distinct, descriptive name.Both new workflows are named "Publish Any Commit," which is confusing in the Actions UI. Differentiate by scope.
-name: Publish Any Commit +name: Continuous Release (packages)
2-2: Scope triggers to relevant branches/paths to reduce noise and cost.Running on every push to any branch can be noisy and expensive. Recommend:
- Run previews on PRs.
- Optionally run on pushes to main.
- Add path filters to only run when relevant packages or lockfile change.
-on: [push, pull_request] +on: + pull_request: + types: [opened, synchronize, reopened] + paths: + - 'packages/fmdapi/**' + - 'packages/webviewer/**' + - 'packages/better-auth/**' + - 'pnpm-lock.yaml' + - '.github/workflows/continuous-release.yml' + push: + branches: [main] + paths: + - 'packages/fmdapi/**' + - 'packages/webviewer/**' + - 'packages/better-auth/**' + - 'pnpm-lock.yaml' + - '.github/workflows/continuous-release.yml'
4-7: Add least-privilege permissions and cancel in-progress duplicates.Helps security posture and avoids redundant runs on rapid pushes to the same ref.
jobs: build: runs-on: ubuntu-latest + permissions: + contents: read + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + env: + CI: true
12-17: Tighten Node setup and caching for stability.
- Prefer 22.x over 22 to get the latest compatible patch.
- Enable check-latest to get freshest patch.
- Explicitly set cache-dependency-path for pnpm lockfile.
- uses: actions/setup-node@v4 with: - node-version: 22 - cache: "pnpm" + node-version: 22.x + check-latest: true + cache: pnpm + cache-dependency-path: pnpm-lock.yaml
18-23: Make installs reproducible and faster.Use frozen lockfile and prefer offline cache; keep build as-is unless workspace scripts require -r.
- name: Install dependencies - run: pnpm install + run: pnpm install --frozen-lockfile --prefer-offline
24-24: Gate pkg-pr-new publishing to PRs; confirm intent vs. “continuous release.”pkg-pr-new is typically for PR preview packages, not production releases. If that’s intended, only run this on pull_request. If you actually want continuous npm releases on main, a separate step with npm publish and provenance would be needed.
- - run: pnpm dlx pkg-pr-new publish './packages/fmdapi' "./packages/webviewer" "./packages/better-auth" --packageManager=pnpm + - if: github.event_name == 'pull_request' + run: pnpm dlx pkg-pr-new publish './packages/fmdapi' './packages/webviewer' './packages/better-auth' --packageManager=pnpmIf you do want a real release on main pushes, I can sketch a follow-up job/step with npm provenance and scoped permissions.
.github/workflows/continuous-release-bin.yml (7)
1-1: Differentiate this workflow’s name from the other one.Avoid identical names in the Actions list.
-name: Publish Any Commit +name: Continuous Release (binaries)
2-2: Constrain triggers to relevant events/paths.Mirror the packages workflow: PR-only for preview publishes; optional push to main; path filters for CLI/typegen and lockfile.
-on: [push, pull_request] +on: + pull_request: + types: [opened, synchronize, reopened] + paths: + - 'packages/cli/**' + - 'packages/typegen/**' + - 'pnpm-lock.yaml' + - '.github/workflows/continuous-release-bin.yml' + push: + branches: [main] + paths: + - 'packages/cli/**' + - 'packages/typegen/**' + - 'pnpm-lock.yaml' + - '.github/workflows/continuous-release-bin.yml'
4-7: Add least-privilege permissions, concurrency, and CI env.Same rationale as the other workflow.
jobs: build: runs-on: ubuntu-latest + permissions: + contents: read + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + env: + CI: true
12-17: Align Node setup and caching.Use 22.x, check-latest, and cache-dependency-path.
- uses: actions/setup-node@v4 with: - node-version: 22 - cache: "pnpm" + node-version: 22.x + check-latest: true + cache: pnpm + cache-dependency-path: pnpm-lock.yaml
18-23: Use frozen lockfile and offline preference.- name: Install dependencies - run: pnpm install + run: pnpm install --frozen-lockfile --prefer-offline
24-24: Limit pkg-pr-new binary publishes to PRs and confirm intent.Previews on PRs are fine; for true “continuous releases,” you’d use npm publish on main with appropriate permissions and tokens.
- - run: pnpm dlx pkg-pr-new publish './packages/cli' './packages/typegen' --bin --packageManager=pnpm + - if: github.event_name == 'pull_request' + run: pnpm dlx pkg-pr-new publish './packages/cli' './packages/typegen' --bin --packageManager=pnpm
4-24: Consider deduplicating these two workflows with a matrix or a reusable workflow.Both files share 95% of steps. You can:
- Use a matrix over package paths and a flag indicating binaries vs. libraries; or
- Extract a reusable workflow that accepts inputs (package list, bin flag) and call it twice.
This reduces drift and maintenance overhead.
I can draft a reusable workflow with inputs for package globs and a bin boolean if you want to go that route.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/continuous-release-bin.yml(1 hunks).github/workflows/continuous-release.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: build
- GitHub Check: build
- GitHub Check: build
- GitHub Check: build
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
.github/workflows/continuous-release.yml (5)
9-11: Fetch full history for tools that diff commits (safer for monorepos and release tooling)Some release tools need history to compute changed packages. Depth 0 prevents subtle failures.
- name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v4 + with: + fetch-depth: 0
12-17: Enable corepack after installing Node and set registry/cache detailsEnabling corepack after setup-node ensures the shims come from the configured Node version. Adding registry-url and cache-dependency-path makes publishing and caching more reliable.
- - run: corepack enable - uses: actions/setup-node@v4 with: node-version: 22 - cache: "pnpm" + cache: "pnpm" + cache-dependency-path: pnpm-lock.yaml + registry-url: 'https://registry.npmjs.org' + - run: corepack enable
18-22: Make installs reproducibleLockfile-respecting installs reduce CI flakiness and accidental version drifts.
- name: Install dependencies - run: pnpm install + run: pnpm install --frozen-lockfileIf this is a workspace, consider driving builds from the root script: pnpm -w build.
5-7: Prevent overlapping publishes on rapid pushesConcurrency avoids double-publishes and “version already exists” races on main.
build: runs-on: ubuntu-latest + concurrency: + group: publish-${{ github.ref }} + cancel-in-progress: true
1-2: Optionally narrow triggers and support tag releasesCurrent triggers are fine, but narrowing reduces noise and allows tag-based releases.
-name: Publish Any Commit -on: [push, pull_request] +name: Publish Any Commit +on: + push: + branches: [main] + tags: ['v*'] + pull_request:If you keep PR trigger, the publish step is already gated to main by the earlier change.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/continuous-release.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: build
| - name: Build | ||
| run: pnpm build | ||
| - run: pnpm dlx pkg-pr-new publish --compact './packages/*' --packageManager=pnpm |
There was a problem hiding this comment.
Block publishing on PRs and wire up npm auth to avoid broken checks and failed publishes
As written, the publish step runs on pull_request where secrets aren’t available, causing failures and red PR checks. Also, publishing needs an npm token and registry config.
Apply this diff to gate publishes to main pushes and provide auth env for pkg-pr-new:
- name: Build
run: pnpm build
- - run: pnpm dlx pkg-pr-new publish --compact './packages/*' --packageManager=pnpm
+ - if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+ env:
+ # Required for publish (pkg-pr-new reads NPM_TOKEN/NODE_AUTH_TOKEN)
+ NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+ run: pnpm dlx pkg-pr-new publish --compact './packages/*' --packageManager=pnpmNote: Ensure a repository secret NPM_TOKEN is set with publish permissions on your registry. If you intend preview publishes on PRs, we can instead guard by repo-owner and add a separate preview step. Want me to draft that?
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Build | |
| run: pnpm build | |
| - run: pnpm dlx pkg-pr-new publish --compact './packages/*' --packageManager=pnpm | |
| - name: Build | |
| run: pnpm build | |
| - if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| env: | |
| # Required for publish (pkg-pr-new reads NPM_TOKEN/NODE_AUTH_TOKEN) | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: pnpm dlx pkg-pr-new publish --compact './packages/*' --packageManager=pnpm |
|
|
||
| - name: Build | ||
| run: pnpm build | ||
| - run: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpm |
There was a problem hiding this comment.
The publish step needs authentication for the package registry before it can successfully publish packages. Consider adding a step like:
- name: Setup npm authentication
run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrcAlso, the current workflow triggers on all pushes and pull requests, which could lead to unintended package publications. It would be safer to add conditions to restrict when publishing occurs:
- name: Publish packages
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpmThis ensures packages are only published from the main branch when changes are pushed directly.
| - run: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpm | |
| - name: Setup npm authentication | |
| run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc | |
| - name: Publish packages | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| run: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpm |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
Summary by CodeRabbit