feat: adopt changesets for automated versioning and publishing by alerizzo · Pull Request #6 · codacy/codacy-cloud-cli

alerizzo · 2026-05-08T13:45:43Z

Summary

Replaces the manual GitHub release → npm publish workflow with changesets, matching the flow used in analysis-cli
Adds a release.yml workflow that uses changesets/action to automatically create a "Version Packages" PR (bumps version, updates CHANGELOG) and publishes to npm when that PR is merged
Adds a changeset-check CI job that requires every PR to include a changeset file (or an explicit --empty changeset for non-version-bump changes)
Removes the old publish.yml workflow that required manually creating a GitHub release with a matching package.json version

New workflow

Make changes, run npx changeset to describe the change and select bump type (patch/minor/major)
Include the generated .changeset/*.md file in the PR
On merge to main, the release workflow creates/updates a "Version Packages" PR
Merging that PR bumps the version, updates CHANGELOG.md, and publishes to npm

Test plan

Verify CI passes on this PR (changeset-check job should pass since this is a CI-only change — add an empty changeset if needed)
After merge, verify the release workflow creates a "Version Packages" PR
On a follow-up PR, verify npx changeset works and the changeset-check job enforces it

🤖 Generated with Claude Code

Replace the manual version bump + GitHub release trigger workflow with changesets, so version bumps and npm publishing are handled automatically via a "Version Packages" PR. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codacy-production · 2026-05-08T13:46:30Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

The PR successfully implements the Changeset infrastructure for automated versioning and publishing. While the project is 'Up to Standards' according to Codacy, two major issues must be addressed before merging:

CI Failure: This PR introduces a mandatory changeset check but does not include a changeset for its own changes, which will lead to a failed CI status.
Release Reliability: The release workflow triggers concurrently with the CI workflow on pushes to the main branch. Without a test step in the release workflow, there is a risk of publishing broken packages if the release completes before a failing CI job finishes.

About this PR

The 'release' script in package.json depends on a prior build step (npm run build). While the release.yml workflow handles this correctly, developers attempting to run 'npm run release' locally may experience failures if they have not manually executed the build first.

Test suggestions

Verify 'changeset-check' CI job fails when no changeset file is added to a PR.
Verify 'changeset-check' CI job passes when a new .changeset/*.md file (excluding README) is present.
Verify 'release.yml' triggers on push to main and correctly uses secrets.NPM_TOKEN for publishing.
Verify 'release' script in package.json correctly invokes the changeset CLI publish command.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-08T13:48:15Z

+      - name: Build
+        run: npm run build
+
+      - name: Create Release PR or Publish


_{🔴 HIGH RISK}

The release workflow currently publishes the package without running tests. Since ci.yml and release.yml run concurrently on pushes to main, a failing build on main could still result in a successful (but broken) package publication. Add a test step before the release action. Try running the following prompt in your coding agent: > Add a 'Test' step running 'npm test' before the 'Create Release PR or Publish' step in .github/workflows/release.yml.

Good catch — adding a test step before publish in release.yml, and setting NPM_CONFIG_PROVENANCE=true to preserve provenance signing.

_{🤖 Generated by /pr-fixup command}

codacy-production · 2026-05-08T13:48:15Z

+      - name: Check for changesets
+        run: |
+          # Count .changeset/*.md files added/modified in this PR compared to the base branch
+          CHANGESETS=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '.changeset/*.md' ':!.changeset/README.md' | wc -l)


_{🟡 MEDIUM RISK}

This PR is missing a changeset file. Based on the logic added in this line, the CI job will fail because no file matching '.changeset/*.md' (excluding README.md) was found in the diff. Please add a changeset using 'npx changeset' or 'npx changeset --empty'.

Already addressed — an empty changeset was added in the second commit (fresh-spoons-build.md). The changeset-check job is now passing.

_{🤖 Generated by /pr-fixup command}

codacy-production · 2026-05-08T13:48:15Z

    "test": "vitest run",
    "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",
-    "prepublishOnly": "npm run update-api && npm run build",
+    "changeset": "changeset",


_{🟡 MEDIUM RISK}

Suggestion: Removing the prepublishOnly hook eliminates a critical safety check. This script ensures that the API client is generated and the project is built whenever a publish is attempted, protecting against manual errors or local publishes of stale code.

Suggested change

"changeset": "changeset",

"prepublishOnly": "npm run update-api && npm run build",

"changeset": "changeset",

Good point — restoring prepublishOnly as a safety net for any accidental local publish attempts.

_{🤖 Generated by /pr-fixup command}

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR migrates the project’s release/publish process from a manual GitHub Release → npm publish flow to a Changesets-driven workflow, aligning automated versioning + changelog generation + npm publishing with the process used elsewhere.

Changes:

Add Changesets tooling/config and scripts to support automated versioning and publishing.
Introduce a new release.yml workflow using changesets/action and remove the legacy publish.yml workflow.
Add a CI job that enforces presence of a changeset file on pull requests.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
package.json	Adds Changesets scripts and devDependencies for versioning/publishing.
package-lock.json	Locks new Changesets-related dependencies.
.github/workflows/release.yml	New automated release workflow to create version PRs and publish to npm.
.github/workflows/publish.yml	Removes the old release-triggered npm publish workflow.
.github/workflows/ci.yml	Adds PR enforcement job requiring a changeset.
.changeset/README.md	Adds Changesets-generated README for contributors.
.changeset/config.json	Adds Changesets configuration (changelog, base branch, access).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

alerizzo · 2026-05-08T14:09:50Z

  "scripts": {
    "test": "vitest run",
    "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",
-    "prepublishOnly": "npm run update-api && npm run build",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release": "changeset publish",
    "start": "npx ts-node src/index.ts",


Agreed — restoring prepublishOnly as a safety net. The release.yml workflow handles the full build pipeline, but prepublishOnly guards against stale local publishes.

_{🤖 Generated by /pr-fixup command}

alerizzo · 2026-05-08T14:10:08Z

+      - name: Check for changesets
+        run: |
+          # Count .changeset/*.md files added/modified in this PR compared to the base branch
+          CHANGESETS=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '.changeset/*.md' ':!.changeset/README.md' | wc -l)
+          if [ "$CHANGESETS" -eq 0 ]; then
+            echo "::error::No changeset found for this PR. Run 'npx changeset' to describe your changes."
+            echo ""
+            echo "If this PR does not require a version bump (e.g., docs-only or CI changes),"
+            echo "add an empty changeset with: npx changeset --empty"
+            exit 1
+          fi


Already addressed — an empty changeset was added in the second commit. The changeset-check CI job is passing.

_{🤖 Generated by /pr-fixup command}

alerizzo · 2026-05-08T14:10:24Z

+      - name: Generate API client
+        run: npm run update-api
+
+      - name: Build
+        run: npm run build
+
+      - name: Create Release PR or Publish
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
+        with:
+          publish: npm run release


Good catch — adding a test step before the changesets action in release.yml.

_{🤖 Generated by /pr-fixup command}

alerizzo · 2026-05-08T14:10:43Z

+          commit: "chore: version packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}


Good catch — adding NPM_CONFIG_PROVENANCE=true to the changesets action env to preserve provenance signing.

_{🤖 Generated by /pr-fixup command}

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.3/schema.json",


- Add test step to release.yml before publishing (Codacy + Copilot review) - Restore prepublishOnly as safety net for local publishes (Codacy + Copilot review) - Set NPM_CONFIG_PROVENANCE=true to preserve provenance signing (Copilot review) - Update README CI/CD section with new changesets workflow - Add versioning/changesets section to AGENTS.md with agent responsibilities - Add agent self-documentation guidelines to AGENTS.md - Update SPECS/deployment.md to reflect new release workflow Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 8, 2026 13:45

Copilot started reviewing on behalf of alerizzo May 8, 2026 13:46 View session

codacy-production Bot reviewed May 8, 2026

View reviewed changes

chore: add empty changeset for CI-only change

7535334

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI reviewed May 8, 2026

View reviewed changes

alerizzo merged commit 0280af1 into main May 8, 2026
5 checks passed

alerizzo deleted the feat/changesets-release-flow branch May 8, 2026 17:19

	"changeset": "changeset",
	"prepublishOnly": "npm run update-api && npm run build",
	"changeset": "changeset",

		@@ -0,0 +1,14 @@
		{
		"$schema": "https://unpkg.com/@changesets/config@3.1.3/schema.json",

Conversation

alerizzo commented May 8, 2026

Summary

New workflow

Test plan

Uh oh!

codacy-production Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo May 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codacy-production Bot commented May 8, 2026 •

edited

Loading