Skip to content

CI and releases

Jump to bottom
mcinquin edited this page Oct 12, 2026 · 1 revision

CI and releases

GitHub Actions

The .github/workflows/ci.yml workflow runs on every push and pull request to main or master:

  • npm ci, then npm run ci:full (Node, ESLint, TypeScript, npm audit high+)
  • build and push the test Docker image on PRs
  • on push to main only: semantic-release (Git tag vX.Y.Z, GitHub Release, CHANGELOG.md, package.json bump, deploy examples in docker-compose.yml), then publish the versioned Docker image from the release job

Locally, run npm run ci before pushing. The full network audit remains available with npm run ci:full.

Versions (semantic-release)

Config: release.config.cjs. Releases are created automatically after a successful CI run on main, based on Conventional Commits (feat:, fix:, refactor:, etc.).

Deploy examples (HOBBYHOOPS_VERSION in docker-compose.yml) are bumped in the same release commit as package.json via scripts/sync-release-examples.mjs.

  • Open a PR and squash-merge with a conventional title (e.g. feat: add collection filter). Direct pushes to main are blocked by branch protection.
  • Merge commits such as Merge pull request #12 do not trigger a version by themselves.
  • GitHub App hobbyhoops-release pushes release commits and tags (bypass ruleset). Repository secrets: RELEASE_APP_ID, RELEASE_APP_PRIVATE_KEY.
  • Settings → Actions → General → Workflow permissions → Read and write permissions (Docker GHCR still uses GITHUB_TOKEN).
  • Docker images :latest and :X.Y.Z point to the commit of the vX.Y.Z Git tag created by semantic-release (not the intermediate push SHA).

Published images:

  • ghcr.io/mcinquin/hobbyhoops:latest
  • ghcr.io/mcinquin/hobbyhoops:X.Y.Z

Pushing to GitHub

Check that no secret or local data will be versioned:

git status
git check-ignore -v data/hobbyhoops.db .env.local

Then commit, push a branch, and open a PR toward main:

npm run ci
git checkout -b feat/my-change
git add .
git commit -m "feat: …"
git push -u origin feat/my-change

Merge the PR on GitHub (squash-merge with a conventional title). semantic-release runs on the resulting push to main.

Never push .env, .env.local, local accounts, or the development SQLite database. See Security.

Related

Clone this wiki locally