test: promote staging to main to trigger 1.1.0 release - #381
Merged
Conversation
Triggers Changesets to bump @deessejs/fp from 1.0.2 to 1.1.0 when the next Version Packages PR is opened on staging. This advances the published npm version past the dummy release-test artifact (1.0.2) and produces the first legitimate minor bump since the Trusted Publishing migration.
Observed on the 1.0.2 dummy release run (30817274927): the tag push step in publish.yml failed with HTTP 403 because the GitHub tag protection rule on 'v*' blocked the github-actions[bot] push. The bot is not an allow-listable actor on tag protection rules — only users, teams, GitHub Apps, and roles are. §4 previously recommended enabling a tag protection rule on v* with an empty allow-list. That recommendation is wrong for any pipeline that uses GITHUB_TOKEN to push tags. The correct senior pattern, used by @deessejs/errors in this same repo and by Vite/Vue/Nuxt/Cloudflare SDK in production, is to skip tag protection entirely and rely on: - environment 'release' as the human gate - anti-republish guard as the no-double-publish check - OIDC provenance as the audit trail - branch protection on main as the gate on direct pushes §4 rewritten to document this decision and explain why tag protection is intentionally absent. No code changes.
chore: 1.1.0 release (advance past 1.0.2 dummy)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the contents of
stagingtomainto finalize the e2e test of the refactored release pipeline (PR #380). This PR brings intomainthe changesetrelease-1.1.0.mdthat was previously merged intostaging.Why
The refactored release pipeline (
publish.ymlafter PR #380) triggers onpull_request: closed(merged) onmain. The new job detects whether the merge commit introduced changeset files, and if so, bumps the version, publishes to npm via Trusted Publishing, creates a git tag, and creates a GitHub Release — all in one run.The changeset for the
1.1.0release is currently onstaging. To trigger the new pipeline, the changeset needs to land onmain. This PR is the staging-to-main promotion that does so.What happens on merge
fd36b5a(the head ofstaging) lands onmain.HEAD~1..HEADof the merge. It finds.changeset/release-1.1.0.md(added).has_changesets = true→ the rest of the job proceeds.pnpm changeset versionbumps@deessejs/fpfrom1.0.2to1.1.0.pnpm build,pnpm test, smoke test.1.1.0→ does not exist → proceed.pnpm changeset publish --tag latestpublishes@deessejs/fp@1.1.0via Trusted Publishing, with provenance attestation.v1.1.0.softprops/action-gh-releasecreates the GitHub Release forv1.1.0.What is being tested
This PR is the e2e validation of the refactored release pipeline. After it merges:
@deessejs/fp@latestshould advance from1.0.2to1.1.0.v1.1.0should exist onmain.v1.1.0should be created with auto-generated notes.Test plan
pnpm turbo type-checkpasses.pnpm turbo lintpasses.1.1.0→ tag + GitHub Release created.Risk
Low. This PR is a fast-forward from
staging. No new content beyond what is already reviewed onstaging. The release pipeline has not yet been exercised end-to-end with this refactored design, so a publish failure is possible (revert the merge commit if so).Rollback
Revert the merge commit on main. The
1.1.0published on npm can benpm unpublish-ed within 72h. The tag and GitHub Release can be deleted manually.🤖 Generated with Claude Code