fix: determine release packages by tag existence on GitHub instead of NPM (#116)

## Summary

The `get-release-packages.sh` script (used for independent-versioning
monorepos) determined which packages belonged to the current release by
querying the npm registry and including any package whose current
version was not yet published. That assumption only holds when this
action runs *before* npm publish.

In the modern publish-release workflow used in `MetaMask/core`,
`action-publish-release` now runs *after* `publish-npm`, so by the time
this script runs every package version may already be on the registry.
The resulting `RELEASE_PACKAGES` is empty,
`getReleaseNotesForMonorepoWithIndependentVersions` produces an empty
string, and the action fails with `The computed release notes are
empty.`

This PR replaces the npm check with a tag-existence check. For each
workspace, the script asks GitHub whether a tag of the form
`<name>@<version>` already exists for the current manifest version. If
the tag exists, the package is considered already released and excluded;
otherwise it's included. Private packages and `0.0.0` packages continue
to be skipped.

The output shape of `RELEASE_PACKAGES` is unchanged, so this is not a
breaking change for downstream steps.

### Behavior change vs. old npm-check

The selection criterion shifts from "not on npm" to "no release tag
exists." In practice these produce the same set for normal-path
consumers, since a version on npm normally corresponds to a tag this
action created. They can diverge in edge cases — e.g. a repo that uses
this action but skips creating tags, or a first-time use against a repo
that's never been tagged in the `<name>@<version>` format (everything
would be treated as unreleased on the first run). Worth calling out in
the release notes; a major version bump on the action tag may be
warranted.

### Other

Also bumps `.nvmrc` from `v14` to `lts/*` since Node.js 14 has been EOL
since April 2023. Happy to split this into a separate PR.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes core release-package selection for independent monorepos and
relies on GitHub API/tag conventions; edge cases (untyped repos or
missing tags) can differ from the old npm-based behavior.
> 
> **Overview**
> Fixes independent monorepo releases when publish runs **after** npm
publish by changing how `get-release-packages.sh` picks packages for the
current release.
> 
> **Release selection** no longer uses `npm view` (“version not on the
registry”). It now includes each public, non-`0.0.0` workspace whose
manifest version has **no** existing Git tag `<name>@<version>`, checked
via `gh api` (optional `RELEASE_TAGS_REPOSITORY` for tests).
`action.yml` passes `GH_TOKEN` into that step.
> 
> **Docs and CI** update README to describe tag-based independent
versioning. The `updated-packages-test` workflow switches the fixture
from `snaps-skunkworks` to `MetaMask/snaps@v120.0.0`, sets
`RELEASE_TAGS_REPOSITORY`, and adjusts manifest bump/unbump expectations
(including patch-0 unbump semantics) so the script still expects **2**
packages in the release set.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f1503fe. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: Mrtenz

.github/workflows/build-lint-test.yml

@@ -22,16 +22,16 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
-          repository: MetaMask/snaps-skunkworks
-          ref: v0.32.2
-          path: skunkworks
+          repository: MetaMask/snaps
+          ref: v120.0.0
+          path: snaps
       - uses: actions/checkout@v3
         with:
           path: action-publish-release
       - name: Get Packages
         id: get-packages
         run: |
-          cd skunkworks || exit
+          cd snaps || exit
           WORKSPACES=$(yarn workspaces list --verbose --json)
           PUBLIC_PACKAGES=()
           PRIVATE_PACKAGE=()
@@ -53,6 +53,13 @@ jobs:
           echo "RELEASE_PACKAGES=$RELEASE_PACKAGES_FORMATTED" >> "$GITHUB_OUTPUT"
       - name: Modify + Get RELEASE_PACKAGES lengths
         id: modify-get-release-packages
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Point the script's release-tag lookup at the checked-out
+          # MetaMask/snaps repo (which has the `<name>@<version>` tag
+          # history) rather than this repo. GITHUB_REPOSITORY itself can't
+          # be overridden at the step level, hence the dedicated var.
+          RELEASE_TAGS_REPOSITORY: MetaMask/snaps
         run: |
           # Update the version in a package.json manifest file
           #
@@ -71,11 +78,11 @@ jobs:
             if [[ "$2" == "unbump" ]]; then
               if [[ "$PATCH" == "0" ]]; then
                 if [[ "$MINOR" == "0" ]]; then
-                  # e.g. 10.0.0 -> 9.9.9
-                  NEW_VERSION="$((MAJOR - 1)).9.9"
+                  # e.g. 10.0.0 -> 9.0.0
+                  NEW_VERSION="$((MAJOR - 1)).0.0"
                 else
-                  # e.g. 1.10.0 -> 1.9.9
-                  NEW_VERSION="${MAJOR}.$((MINOR - 1)).9"
+                  # e.g. 1.10.0 -> 1.9.0
+                  NEW_VERSION="${MAJOR}.$((MINOR - 1)).0"
                 fi
               else
                 # e.g. 1.2.10 -> 1.2.9
@@ -91,16 +98,18 @@ jobs:
             jq --arg version "$NEW_VERSION" '.version = $version' "$MANIFEST" > "$MANIFEST_TEMP"
             mv "$MANIFEST_TEMP" "$MANIFEST"
           }
-          cd skunkworks || exit
+          cd snaps || exit
           IFS="," read -r -a RELEASE_PACKAGES <<< "${{ steps.get-packages.outputs.RELEASE_PACKAGES }}"
-          # These four packages are public and at version 0.32.2
-          # They all have published v0.32.1 versions, but no published 0.32.3
-          # version.
+          # The first four packages are public; their current manifest
+          # versions all match release tags in MetaMask/snaps. Two are
+          # bumped to a version with no tag (included), one is unbumped
+          # to a previously-tagged version (excluded), and one is set to
+          # 0.0.0 (excluded by the 0.0.0 rule).
           update_manifest "${RELEASE_PACKAGES[0]}" "bump"
           update_manifest "${RELEASE_PACKAGES[1]}" "bump"
           update_manifest "${RELEASE_PACKAGES[2]}" "unbump"
           update_manifest "${RELEASE_PACKAGES[3]}" "0.0.0"
-          # This last package is the private examples package
+          # The fifth package is the private examples package.
           update_manifest "${RELEASE_PACKAGES[4]}" "bump"
           ../action-publish-release/scripts/get-release-packages.sh
       - name: Get modified RELEASE_PACKAGES lengths

README.md

@@ -4,7 +4,7 @@ This is a GitHub action that creates a GitHub release for a project that represe
 
 - For a polyrepo package, the action will set the title of the GitHub release to the version of the package specified in `package.json`, and it will set the body of the release to the section of the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)-compatible changelog within the project that matches the version.
 
-- For a monorepo, the action will first determine the set of packages included in the release by choosing each workspace package (the set of packages matched via the `workspaces` field in `package.json`, recursively) whose version specified in its `package.json` is different from its published version on NPM. It will then set the title of the GitHub release to the version of the root package specified in `package.json`, and it will construct the body of the release by stitching together the sections within the changelogs of each package obtained in the previous step.
+- For a monorepo (with independent versioning), the action will first determine the set of packages included in the release by choosing each workspace package (the set of packages matched via the `workspaces` field in `package.json`, recursively) whose current version does not yet have a corresponding Git tag of the form `<package-name>@<version>` (for example, `@metamask/example-package@1.2.3`). It will then set the title of the GitHub release to the version of the root package specified in `package.json`, and it will construct the body of the release by stitching together the sections within the changelogs of each package obtained in the previous step.
 
 Designed for use with [`action-npm-publish`](https://github.com/MetaMask/action-npm-publish) and (indirectly) [`action-create-release-pr`](https://github.com/MetaMask/action-create-release-pr).
 

action.yml

@@ -31,6 +31,8 @@ runs:
       shell: bash
       run: |
         ${{ github.action_path }}/scripts/get-release-packages.sh
+      env:
+        GH_TOKEN: ${{ env.GITHUB_TOKEN || github.token }}
     # This sets RELEASE_NOTES as an environment variable, which is expected
     # by the create-github-release step.
     - id: get-release-notes

scripts/get-release-packages.sh

@@ -6,13 +6,13 @@ set -u
 set -o pipefail
 
 # ============================================================================
-# This script determines which packages to publish in a monorepo. It filters
-# the collection of package metadata passed in to include just the packages to
-# be published, then prints that filtered list.
+# This script determines which packages are part of the current release in a
+# monorepo. A package is considered part of the release if no git tag of the
+# form "<name>@<version>" already exists for its current manifest version.
+# Private packages and packages at version "0.0.0" are skipped.
 #
-# A package will be published if it cannot be found on the npm registry at the
-# current version. Packages with the version "0.0.0" are skipped as well; they
-# are assumed to not be ready for publishing.
+# Tag existence is queried via the GitHub API, so the workflow does not need
+# to fetch tags locally or use a deep checkout.
 # ============================================================================
 
 # JSON string of packages to publish
@@ -37,14 +37,20 @@ len="${#toPublish}"
 
 workspaces=$(yarn workspaces list --verbose --json)
 
+# Repository to look up release tags in. Defaults to the current workflow's
+# repository; can be overridden via the RELEASE_TAGS_REPOSITORY env var
+# (used by the integration tests to point at a fixture repo, since GitHub
+# Actions does not allow overriding GITHUB_REPOSITORY at the step level).
+TAGS_REPOSITORY="${RELEASE_TAGS_REPOSITORY:-$GITHUB_REPOSITORY}"
+
 while read -r location name; do
   MANIFEST="$location/package.json"
   read -r PRIVATE CURRENT_PACKAGE_VERSION < <(jq --raw-output '.private, .version' "$MANIFEST" | xargs)
   if [[ "$PRIVATE" != "true" && "$CURRENT_PACKAGE_VERSION" != '0.0.0' ]]; then
-    # Get the package name as a way to test whether this version is published already
-    PUBLISHED_PACKAGE_NAME=$(npm view "$name@$CURRENT_PACKAGE_VERSION" name || echo '')
-    # If the package name is not set, it implies this version has not been published yet
-    if [ -z "$PUBLISHED_PACKAGE_NAME" ]; then
+    # Skip the package if a release tag already exists for its current
+    # version. A non-existent tag (404) means this version has not been
+    # released yet, so include it.
+    if ! gh api "repos/$TAGS_REPOSITORY/git/ref/tags/$name@$CURRENT_PACKAGE_VERSION" --silent 2>/dev/null; then
       toPublish+="\"$name\":{\"name\":"\"$name\"",\"path\":"\"$location\"",\"version\":"\"$CURRENT_PACKAGE_VERSION"\"},"
     fi
   fi