Release via GitHub actions with changesets and provenance

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/[email protected]/schema.json",
+  "changelog": false,
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "restricted",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.github/workflows/npm-release.yml

@@ -0,0 +1,70 @@
+name: Release new NPM version
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+concurrency:
+  group: changeset-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  npm:
+    name: Changeset release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 16.16
+          cache: 'yarn'
+          cache-dependency-path: '**/yarn.lock'
+
+      - name: Install dependencies
+        run: yarn install --no-progress --ignore-engines
+
+      - name: Check for changesets
+        id: check_changesets
+        run: |
+          if [ -z "$(ls -A .changeset)" ]; then
+            echo "No changesets found. Exiting."
+            echo "changesets_found=false" >> $GITHUB_ENV
+            exit 0
+          else
+            echo "changesets_found=true" >> $GITHUB_ENV
+          fi
+
+      - name: Update package version and remove changesets
+        if: env.changesets_found == 'true'
+        run: npx changeset version
+
+      - name: Commit and push changes
+        if: env.changesets_found == 'true'
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+          git add package.json .changeset
+          git commit -m "Update package version & delete changesets"
+          git push
+
+      - name: Publish to NPM
+        if: env.changesets_found == 'true'
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: npx changeset publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.github/workflows/snapit.yml

@@ -0,0 +1,32 @@
+name: Snapit with npm provenance
+
+on:
+  issue_comment:
+    types:
+      - created
+
+jobs:
+  snapit:
+    name: Snapit
+    if: ${{ github.event.issue.pull_request && github.event.comment.body == '/snapit' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - name: Checkout current branch
+        uses: actions/checkout@v4
+
+      - name: Force snapshot
+        run: |
+          printf -- "---\n'@shopify/buy-button-js': patch\n" > snapshot.txt
+      - name: Create snapshot version
+        uses: Shopify/snapit@0c0d2dd62c9b0c94b7d03e1f54e72f18548e7752 # pin to a specific commit
+        with:
+          github_comment_included_packages: '@shopify/buy-button-js'
+          build_script: 'yarn build'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.gitignore

@@ -17,6 +17,6 @@ _site
 .sass-cache
 .jekyll-metadata
 /test/build
-config.json
+./config.json
 /.vscode
-.DS_Store
+.DS_Store

package.json

@@ -15,7 +15,8 @@
   "repository": "[email protected]:Shopify/buy-button-js.git",
   "publishConfig": {
     "access": "public",
-    "@shopify:registry": "https://registry.npmjs.org/"
+    "@shopify:registry": "https://registry.npmjs.org/",
+    "provenance": true
   },
   "scripts": {
     "start": "rm -rf tmp && mkdir tmp && yarn run src:watch & yarn run styles:watch & yarn run serve",
@@ -68,6 +69,7 @@
     "@babel/plugin-transform-spread": "7.2.2",
     "@babel/plugin-transform-template-literals": "7.4.4",
     "@babel/plugin-transform-typeof-symbol": "7.2.0",
+    "@changesets/cli": "^2.28.1",
     "@shopify/js-uploader": "https://github.com/Shopify/js-uploader.git",
     "aws-sdk": "2.6.8",
     "babelify": "10.0.0",

readme.md

@@ -2,11 +2,11 @@
 
 [BuyButton.js on NPM](https://www.npmjs.com/package/@shopify/buy-button-js)
 
-BuyButton.js is a highly customizable UI library for adding ecommerce functionality to any website. It allows you to create interactive UI components such as product listings and shopping carts with minimal configuration, while allowing you to easily customize the appearance and behaviour of the components.
+BuyButton.js is a highly customizable UI library for adding e-commerce functionality to any website. It allows you to create interactive UI components such as product listings and shopping carts with minimal configuration, while allowing you to easily customize the appearance and behaviour of the components.
 It uses the [JS Buy SDK](http://shopify.github.io/js-buy-sdk/) to connect to your Shopify store, giving you access to your products and collections.
 
 To get started, take a look at [the documentation](http://shopify.github.io/buy-button-js/).
-For questions, suggestions and feeback, please <a href="https://github.com/Shopify/buy-button-js/issues">create an issue</a>.
+For questions, suggestions and feedback, please <a href="https://github.com/Shopify/buy-button-js/issues">create an issue</a>.
 
 > [!NOTE]
 > The Buy Button JS library will soon be updated to use v3 of the JS Buy SDK library
@@ -18,8 +18,8 @@ yarn
 cp index.example.html index.html
 ```
 
-* Add your API key and shop domain to index.html
-* Set a product ID in index.html
+- Add your API key and shop domain to index.html
+- Set a product ID in index.html
 
 ```
 yarn run start
@@ -53,6 +53,7 @@ gem install jekyll
 ```
 yarn run docs
 ```
-Doc server will run at http://localhost:4000/buy-button-js/
+
+Doc server will run at <http://localhost:4000/buy-button-js/>
 Docs source files are located in /docs.
 Docs are automatically deployed to gh-pages from main.

script/deploy.js

@@ -1,9 +1,6 @@
 "use strict";
 
 const Uploader = require('@shopify/js-uploader');
-const path = require('path');
-const fs = require('fs');
-const mime = require('mime-types');
 const currentVersion = require('../package.json').version;
 const awsConfig = require('../config.json').aws;
 const awsSDK = require('aws-sdk');

shipit.production.yml

@@ -5,5 +5,5 @@ dependencies:
 deploy:
   override:
     - ejson decrypt -o config.json config.ejson
-    - npm run deploy
-    - npm publish
+    - npm run deploy # upload built scripts to the CDN
+    # - npm publish (npm publishing is now done via Github actions with changesets and provenance)