CI and releases

CI and releases

GitHub Actions

The .github/workflows/ci.yml workflow runs on every push and pull request to main (changes under .cursor/ are ignored).

Job	Trigger	Role
quality	push / PR to main	npm ci then npm run ci:full
docker	PR to main only	Docker build (validation, no image push)
release	push to main (after quality)	semantic-release, then push GHCR image if a version is published

quality checks

npm run ci:full runs:

1. Node.js version check
2. Presence / format of NEXTAUTH_SECRET
3. prisma generate
4. ESLint
5. Markdownlint
6. TypeScript
7. Unit tests
8. npm audit (severity ≥ high, production deps only)

Locally, npm run ci skips the network audit; npm run ci:full enables it (as in CI).

Releases (semantic-release)

Config: release.config.cjs. On every successful push to main, semantic-release computes the version from Conventional Commits and may publish:

• a Git tag vX.Y.Z
• a GitHub Release
• updates to CHANGELOG.md, package.json, and package-lock.json
• a chore(release): … [skip ci] commit

Then, if a release was published, the Docker image is pushed to ghcr.io/mcinquin/markit with tags vX.Y.Z, X.Y, and latest (stable only).

Secrets and permissions

Secrets (Settings → Secrets and variables → Actions):

• RELEASE_APP_ID — GitHub App ID used to publish releases
• RELEASE_APP_PRIVATE_KEY — private key for that App

Also check Settings → Actions → General → Workflow permissions → Read and write permissions if needed for GHCR (GITHUB_TOKEN with packages: write).

Dependabot

.github/dependabot.yml opens weekly PRs for npm, GitHub Actions, and Docker. With the current releaseRules, chore(deps) / chore(deps-dev) scopes trigger a patch release when merged to main.

Recommended workflow

npm run ci
git checkout -b feat/my-feature
git add .
git commit -m "feat: short description"
git push -u origin feat/my-feature

Open a PR to main, then merge (ideally squash-merge with a conventional title). Never push .env or secrets.

Related

• Docker
• Development