ci(changesets): auto-open Version Packages PR on staging push - #366
Merged
Conversation
Adds .github/workflows/changeset-version.yml implementing the 'Version Packages PR' step from docs/engineering/plans/release-pipeline.md §6.3. Behavior: - Triggered on push to staging. - Runs changesets/action@v1.9.0 (SHA pinned) to open or update a PR titled 'chore: version packages' from branch 'changesets/version' to main. - The PR contains the result of 'pnpm changeset version': bumped package versions, generated CHANGELOG entries, consumed changeset files. - Merging the PR into main triggers release.yml, which publishes to npm via Trusted Publishing. Important: the 'publish' input is intentionally NOT set on the changesets/action. Publishing is the job of release.yml (with its anti-republish guard, smoke test, and SHA-pinned actions). Setting 'publish' here would cause a double-publish. Permissions: - contents: write (to push the version branch) - pull-requests: write (to open/update the Version Packages PR) Hardening: - All third-party actions pinned by commit SHA: - actions/checkout 3d3c42e5 (v7.0.1) - pnpm/action-setup 0ebf4713 (v6.0.9) - actions/setup-node 82076278 (v7.0.0) - changesets/action a45c4d59 (v1.9.0) - No environment required (this workflow does not publish or touch the npm registry). - concurrency group with cancel-in-progress on staging push (a new push cancels the previous attempt).
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/changeset-version.ymlto automate the "Version Packages" PR step fromdocs/engineering/plans/release-pipeline.md§6.3.When code is pushed to
staging, this workflow opens or updates a PR titled "chore: version packages" from branchchangesets/versiontomain. The PR contains the result ofpnpm changeset version: bumped versions, generated CHANGELOG entries, and consumed changeset files.Merging that PR into
maintriggersrelease.yml, which publishes to npm via Trusted Publishing.Why
Before this PR, version bumps had to be done manually:
That was the only path documented in §11 of the plan that wasn't yet implemented. This PR closes that gap.
Changes
.github/workflows/changeset-version.ymlpushtostaging.changesets/action@v1.9.0(SHA pinned ata45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d).publishinput on the action is deliberately not set. Publishing is the job ofrelease.yml(with its anti-republish guard, smoke test, and SHA-pinned actions). Settingpublishhere would cause a double-publish.Hardening
contents: write,pull-requests: write.environment, noid-token— this workflow does not touch the npm registry.concurrencygroup withcancel-in-progress: a new push to staging cancels the previous attempt.Test plan
pnpm turbo type-checkpasses.pnpm turbo lintpasses.stagingafter merge: workflow opens a "Version Packages" PR (empty if no changesets, populated if changesets are present).release.ymltriggers a publish via Trusted Publishing.Risk
Low. The workflow only writes to a non-default branch (
changesets/version) and opens PRs. No publish path, no secrets required beyond the defaultGITHUB_TOKEN.Rollback
Delete the workflow file and remove the remote branch if needed. The
changesets/versionbranch (if any) can be deleted from the GitHub UI.🤖 Generated with Claude Code