From 0ba964fbb63c85c0dd85d7ffbd34ec8b3961d0d4 Mon Sep 17 00:00:00 2001 From: meh Date: Sun, 26 Jul 2026 18:41:32 +0700 Subject: [PATCH] ci: publish on version change instead of via release-please MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-please could not run: creating the release PR needs the repo setting "Allow GitHub Actions to create and approve pull requests", which is off, and job-level pull-requests: write does not substitute for it. The run failed before the publish job started, so nothing was published. Rather than widen Actions permissions, drop the Actions-authored PR. The workflow now compares package.json's version against npm and publishes when it is not there yet. The bump arrives as an ordinary pull request opened by a person or an agent, so the merge checkpoint before an irreversible publish is unchanged, and Actions never authors a PR. Detection queries the exact version rather than `latest`, so re-runs are idempotent. Verified against the live registry: 1.2.11 resolves and is skipped, 1.3.0 does not and would publish. Also tags the release after a successful publish. Tags here had drifted badly — the newest was v1.1.51 while npm was on 1.2.11 — and tagging as part of publishing keeps them honest. Removes the release-please config and manifest, now unused. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 76 ++++++++++++++++++++++------------- .release-please-manifest.json | 3 -- release-please-config.json | 11 ----- 3 files changed, 49 insertions(+), 41 deletions(-) delete mode 100644 .release-please-manifest.json delete mode 100644 release-please-config.json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6903b83..eb20668 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,51 +1,61 @@ name: Release -# Release PR -> merge -> publish. +# Publish on version change. # -# release-please keeps a version-bump + changelog PR open against master. Merging -# it tags the release and triggers the publish job below. Nothing publishes until -# that PR is merged, so this workflow is inert on ordinary pushes. +# When package.json's version is not yet on npm, the publish job runs. The bump +# arrives as an ordinary pull request opened by a person or an agent — GitHub +# Actions never creates a pull request here, so this needs none of the +# "Allow GitHub Actions to create and approve pull requests" permission that +# blocked the previous release-please setup. # -# Publishing uses npm Trusted Publishing (OIDC): there is no NPM_TOKEN anywhere. -# It requires a one-time setup on npmjs.com — +# So the flow is: open a version-bump PR -> merge it -> this publishes. +# Pushes that do not change the version are a no-op. +# +# Publishing uses npm Trusted Publishing (OIDC), so no NPM_TOKEN exists in this +# repository. It requires one-time setup on npmjs.com: # @pathscale/ui -> Settings -> Trusted Publisher -> GitHub Actions # repository: pathscale/ui, workflow: release.yml -# Until that is configured the publish step fails closed; it cannot publish -# unsigned or unauthenticated. +# Without it the publish step fails closed rather than publishing unauthenticated. on: push: branches: [master] + workflow_dispatch: # manual re-run, e.g. if a publish failed after the build permissions: contents: read jobs: - release-please: + check: runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write outputs: - release_created: ${{ steps.release.outputs.release_created }} - tag_name: ${{ steps.release.outputs.tag_name }} + version: ${{ steps.decide.outputs.version }} + publish: ${{ steps.decide.outputs.publish }} steps: - # Version baseline comes from .release-please-manifest.json, not from git - # tags: the newest tag here is v1.1.51 while npm is on 1.2.11, so tag-derived - # versioning would propose a version below what is already published. - - uses: googleapis/release-please-action@v4 - id: release - with: - config-file: release-please-config.json - manifest-file: .release-please-manifest.json + - uses: actions/checkout@v4 + + - name: Is package.json's version already on npm? + id: decide + run: | + version="$(node -p "require('./package.json').version")" + echo "version=$version" >> "$GITHUB_OUTPUT" + # Query the exact version rather than `latest`, so re-runs are idempotent + # and backfilling an older version is still recognised as published. + if npm view "@pathscale/ui@$version" version >/dev/null 2>&1; then + echo "publish=false" >> "$GITHUB_OUTPUT" + echo "::notice::@pathscale/ui@$version is already on npm — nothing to publish" + else + echo "publish=true" >> "$GITHUB_OUTPUT" + echo "::notice::@pathscale/ui@$version is not on npm — publishing" + fi publish: - needs: release-please - if: needs.release-please.outputs.release_created == 'true' + needs: check + if: needs.check.outputs.publish == 'true' runs-on: ubuntu-latest permissions: - contents: read - id-token: write # required for OIDC trusted publishing + provenance + contents: write # create the git tag and GitHub release after publishing + id-token: write # OIDC trusted publishing + provenance steps: - uses: actions/checkout@v4 @@ -86,7 +96,7 @@ jobs: - name: Build run: bun run build - # ---- pre-publish gates. A version can never be reused; fail before shipping. + # ---- gates. A version can never be reused, so fail before shipping. - name: Package check (exports and README resolve against the tarball) run: bun run check:package @@ -99,3 +109,15 @@ jobs: - name: Publish to npm run: npm publish --provenance --access public + + # Tags here have drifted from reality in the past (newest was v1.1.51 while + # npm was on 1.2.11). Tagging as part of publishing keeps them honest. + - name: Tag the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ needs.check.outputs.version }} + run: | + gh release create "v$VERSION" \ + --title "v$VERSION" \ + --generate-notes \ + --verify-tag=false diff --git a/.release-please-manifest.json b/.release-please-manifest.json deleted file mode 100644 index 83cd26e..0000000 --- a/.release-please-manifest.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - ".": "1.2.11" -} diff --git a/release-please-config.json b/release-please-config.json deleted file mode 100644 index 4f035ca..0000000 --- a/release-please-config.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", - "packages": { - ".": { - "release-type": "node", - "package-name": "@pathscale/ui", - "changelog-path": "CHANGELOG.md", - "include-component-in-tag": false - } - } -}